General counsel as business leader, not legal department head.

Section 199 of the Economic Crime and Corporate Transparency Act 2023 received Royal Assent on 26 October 2023 and came into force on 1 September 2025. A relevant body that is a large organization is guilty of an offense if an associated person — an employee, an agent, a subsidiary undertaking or a person performing services for or on behalf of the body — commits a listed fraud offense intending to benefit the body or, in specified cases, its clients. It does not have to be shown that managers ordered the fraud or knew about it. The only defense is proof that the body had such prevention procedures as it was reasonable in the circumstances to expect, or that it was not reasonable to expect any. Section 201 sets the size test at two of three: more than 250 employees, more than £36 million turnover, more than £18 million in total assets. A prevention defense is an operating fact, proved on the balance of probabilities.

The Home Office guidance published on 6 November 2024 and updated on 10 October 2025 sets six principles for those procedures: top-level commitment, risk assessment that is dynamic and documented and kept under review, proportionate risk-based procedures, due diligence, communication including training, and monitoring and review. Its first principle is addressed to the board and to senior management, and it tells them to reject profit based on or assisted by fraud. That is not legal drafting; it is an instruction about how a business is allowed to make money, delivered to the people who decide. On 26 November 2025 the Serious Fraud Office published its Guidance on Evaluating a Corporate Compliance Programme, which lists section 199 reasonable procedures as one of the six scenarios in which it will assess a company's compliance program — alongside the adequate-procedures defense under the Bribery Act 2010, deferred-prosecution-agreement terms and sentencing.

The general counsel of a group that meets the size test is now the person who has to be able to show a prosecutor a designed, tested, documented system that reaches sales incentives, payroll, technical claims and grant applications. The Home Office's own worked examples are drawn from mis-selling, false accounting and falsified environmental data, which is to say from the business, not from the legal department. A candidate who has built that has done commercial work: they have argued about a commission structure, changed an onboarding process, and told a business unit that a target could not be pursued the way it was being pursued.

The second instrument is the one the board signs. The Financial Reporting Council published the UK Corporate Governance Code 2024 on 22 January 2024. Most provisions apply to financial years beginning on or after 1 January 2025, but Provision 29 applies to financial years beginning on or after 1 January 2026, with the first annual reports carrying the new language expected in 2027. Under it the board must describe how it monitored and reviewed the effectiveness of the risk-management and internal-control framework, declare the effectiveness of the material controls as at the balance sheet date, and describe any material controls that did not operate effectively, what was done about them and what has been done about previously reported failures. The FRC scopes material controls across financial, operational, reporting and compliance, and extends reporting controls to narrative and ESG reporting. Principle O, which applies from 1 January 2025, makes the board responsible not only for establishing the framework but for maintaining its effectiveness.

Read the two together and the company is criminally exposed for how it runs while the board must state annually whether the controls over how it runs actually worked. The general counsel owns the compliance and operational-legal segment of that map and has to say which controls are material. Deciding what is material is a risk-appetite decision with commercial consequences, not a drafting exercise.

None of this is a new theory of the director's job. Section 172 of the Companies Act 2006, in force since 1 October 2007, has always required a director to have regard to the long-term consequences of decisions, to employees, to business relationships with suppliers and customers, to the impact of operations on the community and the environment, and to the company's reputation for high standards of business conduct. What has changed since 2024 is that the instruments now give the general counsel the machinery to discharge that duty and the state a way of testing whether it was discharged. A general counsel who advises on the section 172 statement is still in the document business. A general counsel who has changed a supplier, a control or a capital-allocation path is discharging the duty itself.

The American overlay narrows it further for any group with a Delaware subsidiary or a US-listed parent. On 25 January 2023 the Delaware Court of Chancery held for the first time, in In re McDonald's Corporation Stockholder Derivative Litigation, that corporate officers as well as directors owe a Caremark duty of oversight; as Goodwin's alert of 30 January 2023 records, an officer generally answers for red flags within their own area of responsibility, and an officer who receives credible information that the corporation is breaking the law cannot dismiss it as somebody else's problem. Liability still requires bad faith. The scoring question for a board is narrower and more useful: has this candidate owned the information system in their lane, and escalated something inconvenient through it?

Two European instruments finish the picture for regulated and infrastructure businesses. Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has applied to EU financial entities since 17 January 2025 and covers ICT risk management, major-incident reporting, resilience testing, third-party ICT risk and the oversight of critical providers. Directive (EU) 2022/2555, NIS2, has applied since 18 October 2024, and the European Commission states that it introduces accountability of top management for non-compliance with cybersecurity risk-management measures, expressly to bring cybersecurity to the attention of the boardroom. Neither is an IT policy. Both are business processes with a named accountable layer, and the general counsel sits in it.

For completeness, one instrument went the other way, and it is the one a specification is most likely to be built on by accident. The Securities and Exchange Commission adopted its climate-related disclosure rules on 6 March 2024 and voted on 27 March 2025 to end its defense of them. A mandate that asks for experience of that filing is asking for a credential in a regime that is not operating, while the conduct duties in Europe and the control duties in London continue to bind the same group.

Across the trailing three years, Sartori's London in-house desk closed 24 searches, at a 93% completion rate, on a typical timeline of four to seven months, with counter-offer incidence of 32% and a median of 13 working days between offer and signature. Of those 24, 11 named at least one function outside legal in the mandate document — compliance most often, then privacy, then risk, and in three cases the corporate secretary. Four ran past the four-to-seven-month band. In three of those four the reason was the same: the reporting line was rewritten after the search had started, once from the chief financial officer to the chief executive, once in the opposite direction, and once to insert a chief operating officer between the seat and the board.

The interview cohort explains the pattern behind that. Across 750 structured interviews with London general counsel, heads of legal and senior in-house counsel, the 268 respondents at groups with EU operating subsidiaries described where the due-diligence duty had landed: 96 said it sat with procurement or sustainability with legal consulted, 84 said it sat with the general counsel personally, 58 said it was distributed with no single owner, and 30 said the question had not been settled. A separate cut of the same cohort — the 181 respondents whose UK entity met the large-organization test for the failure-to-prevent-fraud offense — produced the number we quote most often to boards: 62 could name the person who owned fraud-prevention procedures, and the offense had been in force for more than a year when they were asked.

Two conversations from that cohort are worth reporting as they were put to us. A head of legal at a privately held European logistics group described being asked to sign a supplier code of conduct she had not been shown before the meeting, and observed that the company had a due-diligence policy and no mechanism by which she could refuse a purchase. A group general counsel at a London-listed industrials company, asked what she would want a successor to be tested on, said she would ask for the decision that had cost the business money, on the reasoning that anyone can describe a process and only the people who have carried one can describe what it cost.

Our own record is weakest exactly where this page says the value lies, and it is worth saying so plainly. Of the 24 closed searches, the 5 whose specifications required demonstrable ownership of a supply-chain or fraud-prevention program took a median of six months to close against roughly four for the rest, and two of the four that overran were in that group. The candidates who can evidence a carried decision are, almost by definition, not looking: they are mid-program, visible internally, and expensive to move. The counter-offer incidence of 32% on this line is highest against exactly that profile. A board that specifies the evidence test correctly should expect a longer search, not a shorter one, and should build the timetable accordingly rather than diluting the specification in month three.

There is also something this desk cannot see, and it changes how the counts above should be read. Sartori maps roughly 30,000 lawyers across London. That map carries employer, seat, practice and movement history; it carries no field for whether a general counsel has ever ended a supplier relationship, argued a materiality question with an audit committee, or advised against a transaction that then did not proceed. There is no public register of carried decisions, and no title from which one can be inferred. Every figure on this page that describes decision ownership comes from asking, either in a structured interview or inside a live mandate — not from a population anyone has yet counted.