Abstract
Paper-compliance lag defines the first-year enforcement pattern visible across three successive UK corporate liability regimes — the Bribery Act 2010 (s.7), the Criminal Finances Act 2017 (ss.45–46), and the Economic Crime and Corporate Transparency Act 2023 (s.199, failure to prevent fraud).
Three successive UK corporate liability regimes — the Bribery Act 2010 (s.7), the Criminal Finances Act 2017 (ss.45–46), and the Economic Crime and Corporate Transparency Act 2023 (s.199, failure to prevent fraud) — share a structurally repeatable enforcement trajectory: legislation passes, guidance follows, organisations adopt paper compliance, and prosecutions arrive years later. The first s.7 corporate conviction took approximately five and a half years. The first prosecution under ss.45–46 took eight. No prosecution has been brought under s.199 since it entered force in September 2025. This paper-compliance lag pattern is not random.. It is produced by identifiable features of legislative design, prosecutorial resourcing, and organisational response — and it is design-predictable. This analysis argues that enforcement agencies should adopt explicit first-year activation protocols for new corporate liability regimes, rather than accepting structural dormancy as an inevitable cost of corporate criminal law.
The Dormancy-Then-Activation Arc
Every major UK “failure to prevent” offence has traced the same arc. Legislation receives Royal Assent. The government publishes guidance — typically months after assent, sometimes after commencement. Organisations respond with compliance documentation. Prosecutors accumulate intelligence. Years later, the first case arrives.
The Bribery Act 2010 entered force in July 2011. The Ministry of Justice published its “adequate procedures” guidance in March 2011 — nine months after Royal Assent but four months before commencement. The first corporate conviction under s.7, Sweett Group PLC, came in February 2016. Five and a half years. Sweett did not rely on the adequate procedures defence — the company admitted its procedures were absent entirely. The penalty was £2.25 million, a fraction of the financial sanctions secured through Deferred Prosecution Agreements over the same period.
The Criminal Finances Act 2017 (ss.45–46, failure to prevent facilitation of tax evasion) entered force in September 2017. HMRC published guidance that year. The first corporate prosecution — against an accountancy firm in Stockport — arrived in August 2025. Eight years. By autumn 2025, HMRC confirmed 11 live investigations, 27 “opportunities” under review, and 121 further cases reviewed but not proceeded with. Citation reflects reported judicial practice. Verify with primary case law databases for specific authority.
The ECCTA 2023 failure to prevent fraud offence (s.199) entered force on 1 September 2025 — nearly two years after Royal Assent in October 2023. Government guidance was published in November 2024. As of March 2026, no prosecution has been brought. The dormancy clock is running.
What Produces the Lag
Compliance commentary treats early dormancy as incidental — a by-product of case-building timelines and prosecutorial caution. It is structural. Four interlocking mechanisms generate it across all three regimes.
Guidance publication timing. In each regime, the gap between Royal Assent and usable guidance opens a window of statutory ambiguity. The MoJ’s Bribery Act guidance drew criticism from Transparency International UK for its insufficient clarity on what “adequate procedures” required — a judgment the House of Lords Select Committee on the Bribery Act endorsed in its 2019 post-legislative scrutiny (HL Paper 303). The Committee found guidance to be vague, high-level, and insufficiently prescriptive. The ECCTA guidance, published twelve months before commencement, was framed as giving organisations time to build fraud prevention procedures. That framing is deliberate design. But it replicates the same compliance-signal-without-enforcement dynamic that characterised each predecessor regime.
Evidential threshold complexity. Each offence imposes a distinct burden that prosecutors must discharge before initiating proceedings. Under ss.45–46 CFA 2017, HMRC must prove that an “associated person” criminally facilitated tax evasion — not merely that the organisation’s controls were deficient. The ratio of 121 cases reviewed but not proceeded with against 11 live investigations tells a clear story: evidential thresholds operate as a structural brake on prosecution volume in the early years, irrespective of political intent.
Prosecutorial resource allocation. The SFO’s first decade of s.7 enforcement was characterised by a marked preference for Deferred Prosecution Agreements over criminal convictions. Six DPAs secured financial sanctions exceeding £1 billion — dwarfing the £2.25 million criminal penalty in Sweett Group. That preference may reflect strategic prioritisation rather than incapacity. But it means criminal conviction rates are a misleading metric for enforcement activity — and organisations calibrating their compliance investment to conviction risk are reading the wrong signal. Under ECCTA s.199, both the SFO and CPS hold prosecution authority. The SFO’s updated Compliance Programme Guidance (November 2025) addresses evaluation criteria for “reasonable fraud prevention procedures” but publishes no case-initiation targets or priority sequencing for the new offence.
Organisational paper compliance. This is the most persistent mechanism and the hardest to measure. When organisations respond to new offences by documenting policies rather than changing conduct, the resulting compliance posture is difficult for prosecutors to falsify at investigation stage. Nine months after the Bribery Act’s commencement, an FTI Consulting survey found that 29% of respondents described themselves as “risk takers” prepared to contravene the Act to win business. Twenty per cent were confident they could do so without detection. Citation reflects reported judicial practice. Verify with primary case law databases for specific authority. That gap — between documented compliance and actual behavioural intent — is precisely where enforcement dormancy takes root.
The 2025 Anti-Corruption Strategy: Signalling Without Sequencing
The UK Anti-Corruption Strategy 2025, published in December 2025, contains 123 stated commitments. It signals expansion of the Domestic Corruption Unit, deployment of AI to accelerate investigations, appointment of a dedicated coordinator for “professional enablers,” and reform of the AML/CTF supervisory regime toward a single regulator.
What it does not contain is an explicit enforcement activation timeline for ECCTA s.199. No prosecutorial priority sequencing for new offences. No case-initiation metrics. No acknowledgment of the structural dormancy pattern that has characterised every preceding failure-to-prevent regime.
The Strategy reads as political signalling — confirming where governmental attention is directed — not as an operational prosecution framework. This is not a deficiency unique to the current government. No UK enforcement strategy has ever published an explicit first-year activation protocol for a new corporate liability offence. The omission spans administrations.
The Counterargument: Dormancy as Design
The strongest objection to characterising early enforcement gaps as structural failure is that they reflect appropriate prosecutorial discretion. The OECD’s Phase 4 UK Report (2017) found that the Bribery Act had prompted substantial progress in corporate anti-corruption compliance — organisations were adopting preventive measures even without prosecutions. Citation reflects reported judicial practice. Verify with primary case law databases for specific authority. On this reading, deterrence operates through the threat of prosecution, not its execution. Early dormancy is an acceptable trade-off for culture change.
The argument has force. It also has limits.
If the enforcement threat is never activated — or activated only against firms that have already admitted to absent procedures, as in Sweett Group — the deterrence signal degrades. The FTI 2012 data showed a significant minority of organisations discounting enforcement credibility within the first year. Eight years of zero prosecutions under ss.45–46 CFA 2017 is not a deterrence strategy. It is a credibility deficit.
The further counterargument — that DPAs constitute active enforcement even when criminal convictions are absent — is jurisdictionally specific. DPAs were available for s.7 Bribery Act cases. Their availability for ECCTA s.199 is not yet tested, and the broader offence scope (Schedule 13 fraud offences) may shift the enforcement calculus entirely. Relying on DPA precedent from one regime to predict enforcement patterns in another is an assumption, not an analysis.
The Cross-Regime Pattern
The enforcement trajectories across all three regimes are structurally consistent:
- Bribery Act s.7 (2010): Commencement July 2011. Guidance lag approximately nine months post-Royal Assent. First corporate prosecution five and a half years post-commencement. No published activation timeline.
- CFA ss.45–46 (2017): Commencement September 2017. Guidance lag approximately six months. First prosecution eight years post-commencement. No published activation timeline.
- ECCTA s.199 (2023): Commencement September 2025. Guidance lag approximately twelve months post-Royal Assent. No prosecution as of March 2026. No published activation timeline.
The dormancy period is lengthening. 5.5 years, then 8. Whether this reflects increasing evidential difficulty, declining prosecutorial capacity, or the normalisation of paper-compliance as a prosecution barrier cannot be determined from current data. No study has disaggregated these variables across regimes.
The Home Office’s Post-Legislative Scrutiny Memorandum for the CFA 2017, published in May 2024 — seven years after commencement — confirmed zero corporate convictions under ss.45–46 at that date. The first prosecution followed four months later. Parliamentary scrutiny did not accelerate enforcement activation.
What the Evidence Does Not Cover
Several material gaps constrain this analysis.
No published survey measures large-organisation compliance adoption rates, board-level engagement, or training uptake in the first six months following ECCTA s.199 commencement. Pre-commencement advisory materials describe what organisations should do. No data establishes what organisations have done. The FTI 2012 survey on Bribery Act adoption is the nearest proxy — but it measured a different offence, in a different enforcement environment, fourteen years ago.
No causal disaggregation study separates prosecutorial resource constraints, evidential threshold complexity, deliberate DPA-preference strategy, and organisational paper-compliance opacity as independent contributors to the dormancy period. This is the single most significant analytical gap for policymakers considering activation-trigger design.
Scotland and Northern Ireland enforcement under both CFA ss.45–46 and ECCTA s.199 is not separately documented. Cross-border enforcement consistency remains uncharted.
No comparative analysis maps UK dormancy patterns against equivalent regimes in other jurisdictions — Australia’s corporate liability reforms, the US FCPA enforcement model, or France’s Sapin II obligations. Whether the UK pattern is exceptional or typical of common law corporate liability design is an open question.
The Case for First-Year Activation Protocols
The evidence supports a specific institutional recommendation: enforcement agencies should publish explicit activation protocols covering the first twelve to twenty-four months of new corporate liability offences.
An activation protocol would not mandate prosecutions within the first year. It would require published metrics — investigation initiation targets, intelligence-gathering benchmarks, sectoral engagement indicators — that signal prosecutorial capacity and intent during the period of highest behavioural uncertainty. The current model, in which guidance is published and enforcement materialises years later, produces a predictable credibility deficit. The compliance industry fills it with paper documentation. The regulated population fills it with rational discounting.
The SFO Director’s public statement that corporations must “get their house in order or be ready to face investigation” is necessary but insufficient. Statements of intent without published enforcement scheduling replicate the signalling pattern that preceded dormancy in both prior regimes.
The UK’s 2025 Anti-Corruption Strategy had an opportunity to break this cycle. It did not take it. Whether the ECCTA s.199 enforcement trajectory will replicate the five-to-eight-year dormancy of its predecessors depends on choices that prosecutors have not yet made public — and that the institutional design of UK corporate criminal enforcement does not currently require them to make.
About VeritasJPS
VeritasJPS provides evidence-based research and advisory at the intersection of corporate criminal liability, compliance science, and institutional enforcement design. Our work supports institutional decision-makers — general counsels, compliance directors, policymakers, and regulators — with rigorous analysis grounded in empirical evidence and legal scholarship.