Fraud Prevention Policy

1. Policy statement

emu24 Limited is committed to the prevention, detection and reporting of fraud and financial crime in all its forms. We operate with honesty, transparency and integrity, and take a zero-tolerance approach to fraud — whether committed by employees, contractors, customers, suppliers or any other third party.

This policy is issued in compliance with the Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023), the Fraud Act 2006, the Proceeds of Crime Act 2002 and related legislation. It forms part of emu24's broader ethical and compliance framework.

2. Scope

This policy applies to all employees at all levels, directors, officers, agency workers, contractors, consultants and any third party acting on behalf of emu24 Limited. It covers all emu24 business activities, systems, assets and financial transactions.

3. What is fraud?

Fraud involves deliberate dishonesty for personal or financial gain, or to cause loss to another. The Fraud Act 2006 defines three principal offences:

Fraud by false representation

Making a false statement — written, spoken or implied — knowing it to be untrue or misleading, with intent to gain or cause loss. Examples: submitting false invoices, falsifying expense claims, or misrepresenting the company's financial position to obtain credit.

Fraud by failing to disclose information

Dishonestly failing to disclose information that you have a legal duty to disclose, with intent to gain or cause loss. Example: concealing a conflict of interest when recommending or awarding a contract to a supplier.

Fraud by abuse of position

Dishonestly abusing a position in which you are expected to safeguard the financial interests of another. Example: an employee with access to the payments system diverting funds to a personal account.

This policy also covers related conduct including:

• Money laundering — concealing or converting the proceeds of fraud or other crime (Proceeds of Crime Act 2002)
• False accounting — falsifying, destroying or concealing financial records
• Cyber-enabled fraud — phishing, business email compromise (BEC) and fraudulent invoice redirection
• Bribery and corruption — governed separately by the Bribery, Gifts & Entertainment Policy

4. The Economic Crime and Corporate Transparency Act 2023 — key provisions

4.1 Failure to prevent fraud (Section 199)

This new corporate offence holds organisations liable where an employee or associated person commits a fraud offence intended to benefit the organisation, and the organisation did not have reasonable fraud prevention procedures in place. The only defence available is to show that either:

• Reasonable fraud prevention procedures were in place at the time of the offence, or
• It was not reasonable in the circumstances to expect such procedures to exist

The offence currently applies to large organisations (meeting two of: £36m+ turnover, £18m+ balance sheet total, 250+ employees). emu24 implements these procedures now as best practice, to protect the business, its customers and employees, and to ensure compliance as the company grows.

4.2 Identity verification at Companies House

The ECCTA 2023 introduces mandatory identity verification for all company directors and persons with significant control (PSCs). emu24 will ensure all directors and PSCs complete verification as required by Companies House, and that all filings are accurate and submitted on time.

4.3 Registered office & email address requirements

All UK companies must maintain an appropriate registered office address (capable of receiving and acknowledging delivery of documents) and provide a registered email address to Companies House. emu24 ensures these requirements are met and kept current.

4.4 Enhanced law enforcement powers

The Act expands powers to seize crypto-assets linked to crime and improves information-sharing between businesses and law enforcement. emu24 will cooperate fully with any lawful request from the Police, HMRC, the Serious Fraud Office or other authorities.

5. Fraud risk assessment

The following risk assessment identifies emu24's key fraud exposures. It is reviewed annually by the Managing Director and updated to reflect changes in the business, technology environment and external fraud landscape.

6. Prevention controls

6.1 Financial controls

• All payments above £500 require authorisation by the Managing Director
• No new supplier or payee bank details may be added without written confirmation from the payee and MD approval
• Any request to change existing bank details must be verified by a telephone call to a previously known number — never to a number provided in the request
• Purchase orders are required for all expenditure above £250
• Monthly bank reconciliation is performed and reviewed by the Managing Director
• Company payment cards are issued only to authorised individuals; statements are reviewed monthly

6.2 Payroll controls

• The Managing Director reviews and approves the payroll schedule before each payment run
• Changes to employee bank details require written instruction from the employee and HR sign-off
• Access to the payroll system is restricted to authorised personnel only
• New starters and leavers are added or removed from payroll on their start or leave date

6.3 Cyber & IT controls

• Multi-Factor Authentication (MFA) is mandatory for all systems including email, online banking and the OrderWise ERP
• Employees must verify any email requesting payment, bank detail changes or urgent financial action by calling the sender on a known number before taking any action
• The IT Lead monitors for signs of email account compromise or unusual system activity
• All employees receive annual phishing awareness training; simulated phishing exercises are conducted periodically
• Full controls are set out in the Information & Security Policy

6.4 Procurement & supplier controls

• All new suppliers are verified via Companies House and their bank details confirmed before first payment
• Employees must declare any personal or financial interest in a supplier or business partner before a purchasing decision is made
• Competitive quotes are obtained for significant purchases in line with the purchasing procedure
• No employee may approve a payment to a supplier in which they have an undisclosed interest

6.5 Expense controls

• All expense claims must be supported by original receipts and submitted within 30 days of the expenditure
• Expense claims are authorised by the employee's line manager
• The Managing Director reviews all claims above £250; spot checks are conducted periodically

6.6 Segregation of duties

Where operationally possible, no single individual should control all stages of a financial transaction:

• The person who approves a payment should not be the same person who processes it
• The person who raises a purchase order should not be the same person who authorises its payment
• The person who manages payroll should not be the same person who approves it

7. Detection

emu24 uses the following mechanisms to detect fraud at the earliest opportunity:

• Regular management review of bank statements, financial records and management accounts
• Periodic reconciliation of stock, assets and financial records
• IT and system access monitoring (see Information & Security Policy)
• Anonymous reporting channel for employees (see Section 8)
• Annual review and update of the fraud risk assessment

8. Reporting concerns

emu24 operates a ‘speak up’ culture. If you suspect or become aware of actual or attempted fraud, or any activity that conflicts with this policy, you must report it immediately. You can do this by:

• Reporting directly to the Managing Director
• Using the company's whistleblowing procedure where you are not comfortable reporting directly

All reports will be taken seriously, treated confidentially where possible, and investigated promptly. No employee will suffer any detriment or disadvantage for raising a genuine concern in good faith, even if it later proves unfounded. This protection is provided under the Public Interest Disclosure Act 1998 (whistleblowing legislation).

9. Investigation

All reports of suspected fraud will be investigated promptly and objectively. The investigation will be led by the Managing Director (or, where the MD is implicated, an independent person). The investigation process will:

• Be proportionate to the nature and scale of the suspected fraud
• Preserve evidence and maintain confidentiality throughout
• Where appropriate, suspend the suspected individual from relevant duties during the investigation
• Involve the Police, Action Fraud and/or the Serious Fraud Office where a criminal offence is suspected
• Result in a written report of findings and recommended actions

Where fraud is confirmed, emu24 will report it to the appropriate authorities and seek to recover all losses. Any victims within or outside the business will be notified as required.

10. Consequences

Any employee found to have committed fraud, facilitated fraud, or knowingly failed to report suspected fraud will be subject to disciplinary action up to and including summary dismissal for gross misconduct. emu24 will report the matter to the Police and pursue civil recovery of losses.

Third parties found to have committed fraud against emu24 will have their contracts terminated and be reported to the relevant authorities. emu24 reserves the right to pursue civil recovery in all cases.

11. Training & awareness

• All employees receive fraud awareness training at induction, covering types of fraud, warning signs and how to report
• Annual refresher training on cyber-enabled fraud and phishing is provided to all staff
• Employees in finance, procurement or IT roles receive additional role-specific fraud prevention training
• The Managing Director will monitor updates to ECCTA 2023 guidance published by the Home Office and update training accordingly

12. Governance & review

The Managing Director has overall responsibility for fraud prevention at emu24 and for ensuring this policy is implemented and maintained effectively. This policy will be reviewed annually and updated to reflect:

• Changes in legislation, including updates to ECCTA 2023 and associated Home Office statutory guidance
• Changes to emu24's operations, systems or risk profile
• Lessons learned from any fraud incidents, near-misses or emerging fraud typologies