Reasonable procedures
Reasonable procedures in practice: what ECCTA evidence teams need to show.
A practical guide for legal, compliance, financial-crime, governance, and adviser teams turning s.199(4), Home Office principles, and SFO evaluation posture into inspectable workpapers.
Start with the two statutory limbs
Section 199(4) gives the relevant body a defence if it proves either that it had prevention procedures that were reasonable in all the circumstances, or that it was not reasonable in all the circumstances to expect any prevention procedures.
The phrase to keep visible is "reasonable in all the circumstances". The file should therefore show the circumstances considered, not just the existence of a policy set.
Treat the burden as an evidence-design problem
The Home Office guidance describes the defence as one for the relevant body to prove, on the balance of probabilities. A readiness file should make the basis for each conclusion inspectable before a board or adviser review.
Useful records include the date of the risk assessment, who owned it, which fraud scenarios were considered, what changed after review, which associated-person populations were covered, and what remained uncertain.
Use the six principles as a frame, not a checklist
The Home Office guidance frames reasonable fraud-prevention procedures around six principles: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication including training, and monitoring and review.
The principles are a non-exhaustive frame. A defence file should connect each principle to source evidence, reviewer decisions, stale items, rejected items, and replacement lineage rather than presenting the principles as tick-box completion.
Show evidence in operation
The SFO compliance-programme evaluation guidance says prosecutors may look beyond policies to how a programme operates in practice. For s.199, that makes operation evidence central: training completion with dates, due-diligence outcomes, monitoring exceptions, issue remediation, and reviewer decisions.
A practical workpaper should separate draft AI-assisted classification from human-approved mapping, record who approved the mapping, and preserve audit events for material changes.
Keep the legal boundary explicit
DefenceFile can help organise the evidence, chase attestations, preserve review history, and surface blockers for board packs.
It does not decide whether procedures were reasonable, whether no procedures were reasonable, whether privilege applies, or whether a statutory defence will succeed. Those conclusions belong with the organisation and its qualified advisers.