Failure to Prevent Fraud: What the UK's Corporate Offence Means for Turkish Groups

Since 1 September 2025, a large organisation can be convicted in the United Kingdom of failing to prevent fraud. The offence is in section 199 of the Economic Crime and Corporate Transparency Act 2023. It is committed when an employee, agent, subsidiary or other associated person commits one of the listed fraud offences intending to benefit the organisation or its client. Nobody at board level need have known about the fraud, and the organisation need not have gained anything from it. Its only defence is that it had reasonable fraud prevention procedures in place at the time.

The offence applies to companies and partnerships wherever they are incorporated, and the size test is applied to the whole group. A Turkish group with British customers, a UK sales subsidiary, UK agents or London financing can therefore be within it, although Turkish law does not impose criminal penalties on companies. The practical risk is that a fraud committed in Bursa or Istanbul, by people the board has never met, becomes a corporate prosecution in London.

We deal with the English rules first and the Turkish rules second, but once a problem arises the two have to be handled together. Readers new to the UK framework may also find our guides to sanctions, beneficial ownership and cross-border payments and to market entry between Türkiye and the UK useful.

1. Why the offence was created

English criminal law has long found it hard to convict a company of an offence that requires dishonesty. The obstacle is the identification doctrine, as stated by the House of Lords in Tesco Supermarkets Ltd v Nattrass [1972] AC 153. Under it, only the state of mind of a person who is the company's "directing mind and will" counts as the company's own. In a large organisation, that person is rarely the one who commits the fraud.

The Serious Fraud Office's case against Barclays showed how narrow the test had become. In SFO v Barclays plc [2018] EWHC 3055 (QB), the High Court refused to reinstate charges against the bank, arising from its 2008 capital raisings with Qatari investors, which the Crown Court had dismissed in May 2018. The knowledge of the chief executive and the group finance director could not be attributed to the bank, because the board had entrusted the transactions to a board finance committee. That was so although the Crown Court judge had found cogent prima facie evidence of dishonesty against the individuals.

Parliament's response has been a series of offences that do not depend on attribution. Section 7 of the Bribery Act 2010 makes a commercial organisation liable for bribes paid by an associated person, subject to a defence of adequate procedures. Section 45 of the Criminal Finances Act 2017 does the same for the facilitation of UK tax evasion, with a defence of reasonable prevention procedures. Section 199 of the 2023 Act extends that model to fraud. The organisation is convicted of its own failure to prevent the fraud, and the burden of proving the defence is on the organisation.

2. The fraud offences that count

Schedule 13 to the Act lists the base offences. For England and Wales, they begin with cheating the public revenue and with false accounting and false statements by company directors under sections 17 and 19 of the Theft Act 1968. They include fraudulent trading under section 993 of the Companies Act 2006. They also include fraud, participating in a fraudulent business and obtaining services dishonestly under sections 1, 9 and 11 of the Fraud Act 2006. Fraud under section 1 can be committed by false representation, by failing to disclose information or by abuse of position. Aiding, abetting, counselling or procuring any of these offences also counts. The Secretary of State can add offences of a similar kind by regulations, including certain money laundering offences.

Each of these offences requires dishonesty on the part of the individual. Under section 2 of the Fraud Act, a representation is false only if it is untrue or misleading and the person making it knows that it is, or might be, untrue or misleading. A product claim that later proves wrong is therefore not fraud by itself. The offence targets dishonest conduct for the organisation's benefit, and compliance work should be aimed at that rather than at every possible error.

The offence came into force on 1 September 2025 under SI 2025/349. It applies only to frauds committed on or after that date.

3. Large organisations and the group test

Section 199 applies only to a large organisation. Under section 201, the test is applied to the financial year before the year of the fraud. An organisation is large if in that year it met at least two of three conditions: turnover above £36 million, a balance sheet total above £18 million and more than 250 employees.

For a parent undertaking, section 202 applies the conditions to the group as a whole, with alternative net and gross thresholds for turnover and balance sheet total. The Home Office guidance confirms that subsidiaries operating wholly outside the UK are counted. A Turkish holding company whose group employs several hundred people and turns over more than £36 million is therefore large, even if its only UK presence is a small sales office in London. "Subsidiary undertaking" has the meaning given in section 1162 of the Companies Act 2006, which looks at voting control, board control and dominant influence rather than ownership alone.

A group company that is not large in its own right can still commit the offence. Under section 199(2), a subsidiary is liable for a fraud by its own employee intended to benefit it if its parent is a large organisation. A Turkish operating company with 150 employees, or a UK subsidiary with a dozen, is therefore within the offence if it belongs to a large group. The guidance adds that LLP networks, supply chain partners and franchises are not aggregated for the size test unless a parent and subsidiary relationship exists between them.

4. Associated persons and the intention to benefit

Section 199(7) treats as associated with the organisation its employees, agents and subsidiary undertakings, and anyone else who performs services for it or on its behalf. That is decided on all the circumstances, not by the label used in the contract. Section 199(8) adds the employees of the organisation's subsidiary undertakings, but only where they intend to benefit the organisation itself rather than a client. A Turkish group's exposure therefore extends to the staff of every group company, to distributors and sales agents acting for it, to consultants and introducers, and to outsourced providers. A supplier that only sells goods to the group is not associated with it. A franchisee is associated only if it performs services for the franchisor.

The associated person must intend to benefit, directly or indirectly, the organisation or a client to whom services are provided on its behalf. No benefit need actually be obtained, and the benefit need not be the main motive. A salesperson who misleads customers to earn a larger commission intends, at least indirectly, to benefit the employer whose sales produce that commission. Section 199(3) excludes a fraud intended to benefit a client where the organisation itself was the victim or intended victim. Fraud against the company, such as theft by an employee, is outside the offence.

The organisation can be prosecuted although the individual is never charged. That has particular significance for Turkish groups. Article 38 of the Turkish Constitution prohibits the surrender of a Turkish citizen to a foreign state for an offence, except under obligations arising from the International Criminal Court. A Turkish employee who commits a fraud from Türkiye may therefore never stand trial in England, while the company that employs that person can be prosecuted there. The prosecution must still prove, to the criminal standard, that the employee committed the base offence.

5. Territorial reach

Section 199 reverses the territorial pattern of the Bribery Act. Section 7 of the 2010 Act applies only to an organisation that carries on business in the UK, but section 12(5) makes the offence complete wherever in the world the bribe is paid. Under section 199, the organisation can be incorporated and run anywhere and need carry on no business in the UK. What must be connected with the UK is the base fraud, which has to be an offence under the law of part of the UK.

For the Fraud Act offences, that question is governed by Part 1 of the Criminal Justice Act 1993. Under section 2(3), a person may be guilty if any "relevant event" occurred in England and Wales. Section 2(1A) provides that, for fraud under section 1 of the Fraud Act, the relevant events include the occurrence of the intended gain or loss. The Home Office guidance summarises the result: a fraud has a UK nexus if one of the acts forming part of it took place in the UK or the gain or loss occurred there.

A false certificate prepared in Bursa and sent by email to a buyer in Leeds therefore has a UK nexus, because the buyer's loss is suffered in England. So does a misstatement in information given to a London lender, a false claim under a UK public scheme and a misrepresentation by a salesperson based in the UK. A fraud by Turkish staff on Turkish customers, with no gain or loss in the UK, is outside the offence. For overseas groups the guidance states the position directly: the organisation can be prosecuted if its employee or associated person commits fraud in the UK or targets victims there.

6. The reasonable procedures defence

Under section 199(4), the organisation has a defence if, when the fraud was committed, it had such prevention procedures as it was reasonable in all the circumstances to expect it to have. It also has a defence if it was not reasonable to expect it to have any procedures. The burden is on the organisation, on the balance of probabilities. Section 204 required the Home Office to publish guidance, which was last updated in October 2025. It rests on six principles: top level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication including training, and monitoring and review.

The guidance is not law. Departing from it does not make procedures unreasonable, and following it does not make them reasonable. At the time of writing there is no reported court decision on the section 199 defence, and the first contested cases will show how the courts approach it.

In our view, a court is likely to give less weight to the quality of a group's written policies than to what actually happened at the point where the fraud occurred. A well drafted code of conduct is of little help if nobody at the plant had read it. Nor is it much help if certificates could be issued without a second signature, or if a concern that was raised went nowhere. The guidance points the same way. It says that it will rarely be reasonable to have carried out no risk assessment at all. It also says that a decision not to address an identified risk should be recorded, with the name and position of the person who approved it.

Two passages of the guidance assist groups based outside the UK. It accepts that procedures for staff and agents abroad may differ from those in the UK, for example where local law does not permit the same procedures. It also says that whether group-wide policies are appropriate for a non-UK group may depend on how much of its activity takes place in the UK or affects victims there. A Turkish group is therefore not expected to transplant a London compliance programme to Bursa. It is expected to identify its UK risk points and to deal with them.

7. Applying the guidance in a Turkish group

The guidance analyses fraud risk in terms of opportunity, motive and rationalisation. In a Turkish exporting group, the opportunity is likely to lie with the people who produce the documents a British customer relies on. These include certificates of origin, test reports, organic and sustainability claims, and declarations under customs or product safety rules. The motive is likely to be commercial pressure from a delivery date, a volume target or a commission on UK orders. Rationalisation is the belief that a document is a formality or that competitors do the same, which the guidance calls ethical fading. A finance team preparing covenant information for a London lender, or a team bidding for a UK public contract, presents a different but equally specific risk.

The risk assessment should identify those points, the group companies and individuals involved, and the person responsible for each risk. It should be revisited when the business changes, for example on taking a new UK customer, making a new product claim or completing an acquisition. Procedures then follow from the assessment. For a typical exporter that means an independent check before any certificate or test result goes to a UK customer, and incentive schemes that do not reward volume however it is achieved. It also means conflict of interest declarations from those who approve UK sales, and agency and distribution contracts that require compliance and allow termination for breach. The guidance expects organisations to test their controls, and a control that has never been tested is weak evidence.

Due diligence should be proportionate. A distributor that will make representations to British customers in the group's name needs closer scrutiny than a supplier of raw materials. On acquisitions, the guidance warns that a target which was not itself a large organisation may have no procedures aimed at this offence. It expects the buyer to assess the target's risks and to extend its own procedures after completion. That applies to a Turkish group buying a UK business and equally to a UK buyer of a Turkish company.

Training should explain the offence itself as well as the internal rules, beginning with the roles that carry the most risk. Where the risk sits in Türkiye, training has to be given in Turkish. A whistleblowing channel should be independent of line management and protect those who use it from retaliation. Reports received in Türkiye are personal data, and their transfer to a UK parent or provider needs a basis under Article 9 of Law No. 6698, discussed in section 11 below. Many groups already investigate frauds committed against them. The guidance expects those arrangements to extend to frauds committed for the organisation's benefit, which are harder to detect because no one inside the group has an obvious reason to complain.

8. The Turkish board's position

Turkish company law already requires the oversight that the guidance describes. Article 375(1)(e) of the Turkish Commercial Code No. 6102 makes high-level supervision of those charged with management a non-delegable duty of the board of a joint stock company. That supervision covers compliance with the law, the articles of association and internal directives. A fraud prevention framework adopted by the parent's board, with regular reporting to the board, is a natural way of discharging that duty for UK-facing risk.

The duty has a liability side. Under Article 553, board members who breach their duties under the law or the articles by fault are liable for the resulting loss. They are liable to the company, to the shareholders and to the company's creditors. A Turkish company may pay a fine, or a sum under a deferred prosecution agreement, in London because it had no procedures. Shareholders may then ask whether the board's failure to put procedures in place breached Article 375. We are not aware of a Turkish decision on that question, and the answer will turn on the facts, but boards should expect it to be asked. Our article on directors' duties, D&O insurance and board crisis strategy discusses the board's oversight role and its insurance.

9. The senior manager rule since June 2026

Section 250 of the Crime and Policing Act 2026 has applied since 29 June 2026 and widens corporate attribution for all offences. Where a senior manager of a body corporate or partnership commits an offence while acting within the actual or apparent scope of their authority, the organisation also commits it. A senior manager is an individual who plays a significant role in decisions about how the whole or a substantial part of the organisation's activities are managed or organised, or in actually managing or organising them. Section 250 replaced sections 196 to 198 of the 2023 Act, which had applied the same rule to listed economic crimes only.

Section 250 has no size threshold and no defence of reasonable procedures. It applies to bodies incorporated outside the UK. Its one territorial exception requires two things: all the conduct constituting the offence must occur outside the UK, and the organisation must not have committed the offence had that conduct been its own. A fraud that causes loss to a customer in England is an English offence even when committed from abroad, so the exception will rarely help where a UK customer or lender is deceived.

The two regimes overlap. Under section 199, a large organisation answers for fraud by an associated person unless it proves reasonable procedures. Under section 250, any organisation is itself guilty of a fraud committed by its senior manager within the scope of that manager's authority. If facts like those in Barclays arose today, the question would be whether the individuals were senior managers acting within their authority, not whether they were the company's directing mind and will. In a Turkish group, a general manager or regional sales director who personally approves false statements to UK counterparties exposes the employing company to direct liability.

10. How Turkish law treats the same facts

Article 20 of the Turkish Criminal Code No. 5237 provides that criminal responsibility is personal and that criminal sanctions cannot be imposed on legal persons. It preserves the security measures provided by law. Article 60 allows the cancellation of a licence and confiscation where an offence is committed for the benefit of a private law legal person, in the cases the law specifies. Article 169 applies those measures to legal persons that obtain an unjust benefit from theft, breach of trust or fraud.

The main financial sanction is administrative. Article 43/A of the Misdemeanours Law No. 5326 allows a fine on a legal person where certain offences are committed for its benefit. The offences include fraud under Articles 157 and 158 of the Criminal Code, bribery, bid rigging and money laundering. The offender must be an organ or representative of the legal person, or someone who, without being either, acts within the scope of its activities. The statutory range is TL 10,000 to TL 50 million, revalued every year under Article 17(7), and the fine may not be less than twice the benefit involved. It is imposed by the criminal court that hears the case against the individual.

The individuals face the Criminal Code directly. Fraud under Article 157 carries one to five years' imprisonment. Under Article 158(1)(h), fraud committed by a merchant, a company manager or a person acting on behalf of a company in the course of commercial activity is qualified fraud. It carries three to ten years' imprisonment and a judicial fine of up to 5,000 days. Under Article 8, an offence is committed in Türkiye if the act took place there in whole or in part or its result occurred there. A certificate prepared in Bursa for a buyer in Leeds is therefore within both systems. English law applies because the loss occurs in England, and Turkish law applies because the act took place in Türkiye.

Two sets of proceedings can therefore run on the same facts against different defendants. In London the company is the defendant. In Türkiye the individual is the defendant, and the company is drawn in through the Article 43/A fine and any security measures. Admissions in a deferred prosecution agreement, or statements in a Turkish criminal file, may come to the attention of the authorities in the other country. Each step should be planned with that in mind.

11. Evidence held in Türkiye

The SFO's main compulsory power is the notice under section 2(3) of the Criminal Justice Act 1987. The leading case is R (KBR, Inc) v Director of the Serious Fraud Office [2021] UKSC 2. The Supreme Court held that the power does not allow the SFO to require a foreign company to produce documents it holds outside the UK. The SFO had handed the notice to an officer of the US parent at a meeting in London. That did not cure the absence of territorial reach, and the Supreme Court rejected a test based on a "sufficient connection" with the UK.

The UK subsidiary of a Turkish group can still be required to produce what it holds. For material in Türkiye, the SFO can seek mutual legal assistance. Such requests are governed by the Law on International Judicial Cooperation in Criminal Matters No. 6706. The Turkish Ministry of Justice is the central authority, and treaties to which Türkiye is a party take precedence. The formal route is slow, and the SFO's co-operation guidance expects a co-operating company to identify and produce relevant overseas documents within its control, with translations. A Turkish group that wants credit for co-operation will therefore usually be producing material from Türkiye voluntarily.

Voluntary production raises a Turkish data protection question. Investigation files contain personal data of employees, customers and counterparties. Article 9 of Law No. 6698 was amended in 2024. It allows transfers abroad on the basis of an adequacy decision or an appropriate safeguard, such as the standard contract published by the Personal Data Protection Board. A standard contract must be notified to the Authority within five business days of signature, and it is not designed for disclosures to a prosecutor. Where neither an adequacy decision nor a safeguard is available, Article 9(6)(d) permits an incidental transfer where it is necessary for the establishment, exercise or protection of a right. Whether a disclosure to the SFO fits that ground should be assessed, and the assessment recorded, before any material leaves Türkiye. Our KVKK compliance guide explains the transfer rules in more detail.

12. Internal investigations: privilege and Turkish employment law

How an investigation is set up determines what can later be withheld. The leading authority is Director of the SFO v Eurasian Natural Resources Corporation Ltd [2018] EWCA Civ 2006. The Court of Appeal held that litigation privilege can protect documents created in an internal investigation once criminal proceedings are reasonably in contemplation. That point may be reached before the SFO opens a formal investigation. Privilege depends on the documents having been created for the dominant purpose of resisting or avoiding those proceedings. Notes of interviews conducted by managers without lawyers are at risk of not being privileged.

Turkish law protects the lawyer and client relationship in a different way. Article 36 of the Attorneys' Act No. 1136 prohibits lawyers from disclosing what is entrusted to them in their professional capacity. Article 130 of the Code of Criminal Procedure No. 5271 permits a search of a lawyer's office only by court order. The search takes place under the supervision of a public prosecutor and in the presence of a representative of the bar. These rules protect the lawyer's professional secrecy and the lawyer's office. A group should not assume that investigation material kept on company premises in Türkiye is shielded in the same way.

Turkish employment law adds a timing problem. Article 25(II) of the Labour Law No. 4857 allows termination for breach of the duty of honesty and loyalty. Under Article 26, the employer may exercise that right only within six working days of learning of the conduct. In any event this must be done within one year of the conduct, unless the employee obtained a material benefit from it. The SFO's guidance asks a co-operating company to inform it in advance of witness interviews and other investigative steps, so that they can be deconflicted from the SFO's own investigation. A dismissal, and any interview held before it, may be such a step. A group that has self-reported, or is considering doing so, should agree the sequence with the SFO early. Otherwise it may have to choose between losing the right to dismiss for cause and prejudicing the SFO's work.

The guidance also expects current and former employees, whether in the UK or overseas, to be made available for interview, with independent legal advice where appropriate. Turkish employees asked to attend an SFO interview may need advice on the consequences in Türkiye of what they say. That advice should come from their own lawyer, not the company's.

13. Self-reporting and deferred prosecution agreements

Section 206 added the offence to Schedule 17 to the Crime and Courts Act 2013, so that it can be resolved by a deferred prosecution agreement. It also extended the investigatory powers in section 61 of the Serious Organised Crime and Police Act 2005 to the offence. It made the offence a serious offence for the purposes of serious crime prevention orders. Under a deferred prosecution agreement, the prosecution is suspended while the organisation complies with agreed terms. These can include a financial penalty, compensation for victims, disgorgement of profit, a compliance programme and co-operation in related investigations. The agreement must contain a statement of facts, which may include admissions. It takes effect only when the Crown Court declares that it is in the interests of justice and that its terms are fair, reasonable and proportionate.

The Bribery Act cases show that this route is used for groups based outside the UK. In January 2020 the Crown Court approved an agreement between the SFO and Airbus SE. It covered five counts of failing to prevent bribery under section 7, concerning conduct in Sri Lanka, Malaysia, Indonesia, Taiwan and Ghana, and payments of almost €991 million.

The SFO's co-operation guidance was first published on 24 April 2025 and updated on 13 October 2026. It states that a company which self-reports promptly and co-operates fully will be invited to negotiate a deferred prosecution agreement rather than be prosecuted, unless exceptional circumstances apply. The SFO aims to decide whether to open an investigation within six months of a self-report. Where possible, it aims to conclude negotiations within six months of an invitation being accepted. A knowing failure to self-report promptly counts against the company. A company that maintains a valid claim to legal professional privilege is not penalised for doing so, although a waiver is treated as a significant co-operative act. The guidance also asks for an analysis of the compliance programme in place at the time of the offending and of the remediation since. The quality of the group's procedures therefore matters even in a negotiated outcome.

For a Turkish group, the decision whether to report cannot be taken in London alone. The facts will be relevant in Türkiye, the material will need a lawful basis to leave Türkiye, and the individuals may face Turkish proceedings. Our article on regulatory enquiries and dawn raid readiness in Türkiye covers the Turkish side of an investigation.

14. Penalties and public contracts

On conviction on indictment, the fine is unlimited. On summary conviction in England and Wales it is also unlimited, while in Scotland and Northern Ireland a summary fine cannot exceed the statutory maximum. A serious crime prevention order can impose continuing restrictions on the way the organisation does business.

For groups that sell to the UK public sector, the Procurement Act 2023 needs separate attention. A conviction under section 199 is not itself a mandatory exclusion ground under Schedule 6. A contracting authority may, however, treat the underlying conduct as professional misconduct involving dishonesty. That is a discretionary exclusion ground under paragraph 11 of Schedule 7. The individual's conviction may matter more than the company's. Schedule 6 makes the conviction of a supplier or a connected person for fraud under sections 2 to 4 of the Fraud Act a mandatory ground. Paragraph 34 extends that to equivalent offences under foreign law. Connected persons include the supplier's directors, persons with significant control over it and its parent and subsidiary undertakings. A Turkish conviction under Article 157 or 158 of a director of the bidding company, or of a person with significant control over it, could therefore lead to mandatory exclusion.

Exclusion is not automatic even then. Under section 57, a supplier is excluded only if the authority considers that the circumstances giving rise to the ground are continuing or likely to occur again. Section 58 allows the authority to take into account steps such as changes of staff or management and new procedures and training. The supplier must be given a reasonable opportunity to make representations. A group that can show what it changed after a fraud is in a materially better position.

15. A worked example

A Turkish home textiles group is headed by a joint stock company in Istanbul. It owns a weaving and finishing company in Bursa and a sales company in Manchester that supplies British retailers. The group has a turnover of £120 million and 2,000 employees, almost all in Türkiye. The Manchester company has twelve employees and a turnover of £15 million.

In 2026 the quality manager at the Bursa company faces a shortage of certified organic cotton. To keep a British retailer's order, the manager issues certificates stating that a shipment of towels was made from certified organic cotton when much of it was conventional. The Manchester company forwards the certificates without checking them, and the retailer pays the organic premium.

The fraud has a UK nexus, because the representation was made to a buyer in England and the loss was suffered there. The quality manager is employed by a subsidiary undertaking of the Istanbul parent. If the manager intended to benefit the Bursa company, that company can be guilty under section 199(2), although it is not large in its own right. If the intention was to benefit the Istanbul parent, even indirectly through the group's results, the parent can be guilty through section 199(8). Had the Bursa general manager approved the certificates, section 250 would be likely to make the Bursa company directly guilty of the fraud, with no defence of procedures available.

At present the group has a code of conduct in Turkish that does not mention product claims. It has no fraud risk assessment and no reporting channel at the Bursa plant, and nobody in Manchester is responsible for checking certificates against test results. On those facts the defence would be difficult to establish. In Türkiye, the same certificates may amount to qualified fraud under Article 158(1)(h), and the criminal court could fine the Bursa company under Article 43/A. Suppose the group discovers the problem and wants to dismiss the quality manager. The six working day period under Article 26 of the Labour Law will then be running while it decides whether to self-report.

A prepared group would be in a different position. Its Istanbul board would have adopted a fraud prevention policy and received a risk assessment identifying product claims to UK buyers as a principal risk. A named person at the Bursa company would be responsible for fraud prevention, and certification data would be checked independently before any certificate was issued. Staff in Bursa and Manchester would have been trained on the legal consequences of false claims, and a confidential reporting channel would be available in Turkish and English. When the problem came to light, the group would instruct external lawyers so that privilege could be claimed and would preserve the evidence. It would then decide quickly, with advice in both countries, whether to report. None of that guarantees an acquittal. It does give the group evidence for its defence and material to put before a contracting authority under section 58 of the Procurement Act.

Conclusion

Taken together, sections 199 and 250 have changed the position of a Turkish group that does business with the UK. A fraud by a junior employee in Türkiye can lead to the prosecution of a Turkish company in London. It is enough that the employee meant to benefit the company and that the victim is in the UK. The company's answer will then be the procedures it had at the time. A fraud approved by a senior manager can lead to conviction with no defence at all.

Our advice to a Turkish board is to start with the size test, applied to group figures. The next step is a written assessment of the points at which the group deals with UK customers, lenders and authorities. Procedures should be built at those points rather than across the whole group, adopted by the board as part of its duty under Article 375 of the Commercial Code, and tested. The group should also decide in advance how it would investigate a suspected fraud. That means deciding which lawyers would be instructed, how data would leave Türkiye lawfully, how Turkish employment deadlines would be handled and who would decide whether to report to the SFO.

How Terziolu & Partners Can Assist

Terziolu & Partners advises Turkish groups on fraud prevention frameworks for their UK exposure within our regulatory and compliance work. That includes risk assessments, group policies and board reporting, due diligence on agents and distributors, and the Turkish data protection, employment and corporate law aspects of monitoring and investigations. Through our dispute resolution work, we act in internal investigations and in Turkish proceedings arising from the same facts.

Where a matter involves UK authorities or proceedings in London, we coordinate the Turkish and English steps between Istanbul and London through our cross-border legal coordination work, with appropriately qualified counsel in each jurisdiction. Contact us to review your group's exposure or to respond to a suspected fraud.

Selected Legislation, Authorities and Materials

United Kingdom

Economic Crime and Corporate Transparency Act 2023, section 199: the failure to prevent fraud offence; with sections 200 to 206 on the list of offences, large organisations, parent undertakings, guidance and consequential amendments.

Economic Crime and Corporate Transparency Act 2023, Schedule 13: the base fraud offences.

Economic Crime and Corporate Transparency Act 2023 (Commencement No. 4) Regulations 2025 (SI 2025/349): commencement on 1 September 2025.

Crime and Policing Act 2026, section 250: criminal liability of bodies corporate and partnerships where a senior manager commits an offence, in force on 29 June 2026.

Fraud Act 2006, section 1: fraud by false representation, failing to disclose information and abuse of position.

Criminal Justice Act 1993, section 2: jurisdiction over Group A offences and the "relevant event", including the gain or loss in a fraud.

Bribery Act 2010, section 7, Bribery Act 2010, section 12 and Criminal Finances Act 2017, section 45: the earlier failure to prevent offences and their territorial reach.

Crime and Courts Act 2013, Schedule 17: deferred prosecution agreements, including their content (paragraph 5) and approval by the Crown Court (paragraph 8).

Procurement Act 2023, Schedule 6, Schedule 7, section 57 and section 58: mandatory and discretionary exclusion grounds, connected persons, foreign offences and remedial steps.

Tesco Supermarkets Ltd v Nattrass [1972] AC 153 (HL): the identification doctrine.

SFO v Barclays plc [2018] EWHC 3055 (QB): attribution of senior executives' knowledge to a company under the identification doctrine.

R (KBR, Inc) v Director of the Serious Fraud Office [2021] UKSC 2: no power under section 2(3) of the Criminal Justice Act 1987 to compel a foreign company to produce documents held abroad.

Director of the SFO v Eurasian Natural Resources Corporation Ltd [2018] EWCA Civ 2006: litigation privilege over internal investigation documents.

Home Office, Guidance to organisations on the offence of failure to prevent fraud (updated October 2025): scope, territoriality and the six principles.

Serious Fraud Office, Cooperation Guidance (published April 2025, updated October 2026): self-reporting, co-operation, internal investigations and deferred prosecution agreements.

Türkiye

Constitution of the Republic of Türkiye: Article 38 (no surrender of citizens to a foreign state for an offence).

Turkish Criminal Code No. 5237 (TCK): Articles 8 (territorial application), 20 (personal criminal responsibility; no criminal sanctions against legal persons), 60 (security measures for legal persons), 157 and 158 (fraud and qualified fraud) and 169 (security measures for legal persons benefiting from fraud).

Misdemeanours Law No. 5326: Article 17(7) (annual revaluation of administrative fines) and Article 43/A (administrative fines on legal persons).

Code of Criminal Procedure No. 5271 (CMK): Article 130 (search of lawyers' offices).

Law on International Judicial Cooperation in Criminal Matters No. 6706: Articles 1 and 2 (scope, treaties and the Ministry of Justice as central authority).

Turkish Commercial Code No. 6102 (TTK): Articles 375 (non-delegable duties of the board) and 553 (liability of board members).

Labour Law No. 4857: Articles 25(II) (termination for breach of honesty and loyalty) and 26 (six working day and one year limits).

Attorneys' Act No. 1136: Article 36 (professional secrecy).

Personal Data Protection Law No. 6698 (KVKK): Article 9 (transfers abroad, including incidental transfers under paragraph 6), as amended by Law No. 7499 in 2024.