Anti-Bribery Training: UK Bribery Act Requirements for 2026

Imagine the SFO asks for your anti-bribery training records. You hand over a 47-slide module, rolled out once a year, with a completion report that shows who clicked "finish." Then comes the follow-up question: did the sales director who manages your agents in a high-risk market get anything different from the receptionist?

That is where a lot of programs come unstuck. "Training was available" is a different statement from "adequate procedures were in place" under section 7 of the Bribery Act 2010. Investigators won't care how polished the module looked. They will care whether it matched the risks your people faced, who actually completed it, and when it was last reviewed.

This guide covers what anti-bribery training needs to do in 2026, how the ECCTA failure to prevent fraud offense changes the picture, and how to build a program you can defend.

Why "we have training" is not enough

Section 7 of the Bribery Act creates a corporate offense of failing to prevent bribery. If a person associated with your organization bribes someone to win or keep business for you, the organization is guilty unless it can show it had adequate procedures in place to prevent it. That defense is the whole game.

The Ministry of Justice guidance sets out six principles for judging "adequate." Communication, including training, is the fifth. The guidance expects training to be proportionate to the risk: more for people and third parties who face higher exposure, less for those who don't. A single generic course for everyone is hard to defend on that test.

The SFO's updated guidance on evaluating corporate compliance programs, published on 26 November 2025, says there are no pre-ordained answers on effectiveness and that each assessment is case by case. So there is no checklist to tick. The practical reading is simple. Be ready to show what training you gave, to whom, why that was the right level, and that it was kept current.

What the penalties look like

Under section 11, an individual convicted on indictment of bribing, being bribed or bribing a foreign public official faces up to 10 years in prison, an unlimited fine, or both. An organization convicted of failing to prevent bribery faces a fine on conviction on indictment, with no cap. Beyond the fine, organizations should expect:

• Confiscation of the proceeds of the offending, which can exceed the value of the bribe.
• Possible exclusion from public sector contracts and tenders.
• Reputational damage with customers, partners and lenders.

The Ultra Electronics case shows the scale. In May 2026 a court approved a deferred prosecution agreement under which Ultra Electronics Holdings paid a £10 million penalty plus £4.8 million in SFO costs. The case involved third-party agents used to pursue public contracts in Oman and Algeria.

The six principles, and the one investigators find lacking

The six principles are deliberately flexible. They are a framework you adapt to your own risk profile, and the same framework is used to judge whether a program is genuine or window dressing.

In our experience, principle five is where programs look thinnest. The training exists, but it was written years ago, it's the same for everyone, and nobody can produce clean completion records. The people with the most exposure got the same content as everyone else.

ECCTA: why 2026 is a different environment

On 1 September 2025 the failure to prevent fraud offense in the Economic Crime and Corporate Transparency Act 2023 came into force. A large organization can now be criminally liable when an associated person, such as an employee, agent or subsidiary, commits fraud intending to benefit the organization. The defense is having reasonable prevention procedures in place.

"Large" means meeting at least two of three tests: more than 250 employees, more than £36 million turnover, or more than £18 million in total assets. The Home Office guidance behind the offense uses a similar set of principles to the Bribery Act, including training, so one program can serve both.

Corporate liability is also widening. The Crime and Policing Act 2026 received Royal Assent on 29 April 2026. Section 250, in force from 29 June 2026, makes an organization guilty of any offense under UK criminal law (England and Wales, Scotland and Northern Ireland) committed by a senior manager acting within the actual or apparent scope of their authority. Unlike the failure to prevent offenses, it has no reasonable-procedures defense. That makes training for senior managers more important, not less.

What "proportionate and risk-based" means in practice

The Act doesn't prescribe a training format, a duration or a platform. It asks that training fit the risk the person faces. Organizations usually miss in one of two ways: one generic module for everyone, or that same module doing double duty for higher-risk roles.

Who needs what

A mailroom operative and a commercial director managing agents in Southeast Asia don't face the same risk. A defensible program separates at least three groups.

What the content must cover

Beyond the offenses themselves (bribing, being bribed, bribing a foreign public official and failing to prevent bribery), good content covers the less obvious ground:

• Bribery isn't only cash. Gifts, hospitality, travel, job offers and discounts for family members all count. People can't report what they can't recognize.
• Facilitation payments. Small payments to speed up routine government actions are bribes under UK law. This catches out staff who worked under regimes that tolerate them.
• Your own policies. The gifts register, hospitality approval limits and the route for flagging a suspicious third-party request, not just the legislation.
• How to report concerns. Staff need to know the whistleblowing channel and the protections in the Public Interest Disclosure Act 1998. If people don't feel safe using it, it's decoration.

Third parties and associated persons

Section 8 defines an associated person as anyone who performs services for or on behalf of the organization, in whatever capacity. Employees, agents and subsidiaries are the usual examples, and the label on the contract matters less than the facts. The section 7 offense also reaches bribery committed anywhere in the world, so a bribe paid by an agent in another country can become your problem if you carry on business in the UK.

The Ministry of Justice guidance treats communication and training as something that can extend beyond your own payroll. For higher-risk agents, distributors and intermediaries, share your anti-bribery policy, ask them to confirm in writing that they have read it, and offer short training where the relationship justifies it. Keep a record of what you sent and what came back.

Train the people who manage those relationships too. Procurement, commercial and finance staff are the ones who see an unusual commission request, an invoice that doesn't match the work or a payment routed through a third country. They need to know which of those signals to escalate, and to whom.

Why traditional anti-bribery training fails

Most compliance teams already know the problem. The long annual module gets rushed, skimmed or left until the deadline. The completion record says "done." It says nothing about whether the sales director would know what to do when an agent asks for an unusual commission.

Three structural reasons

Better slides won't fix this. The format is the issue:

• Too long. A 60-minute module asks people to absorb dozens of concepts in one sitting, then never revisits them.
• Too generic. One module for 3,000 people treats a junior administrator and a commercial director the same. That isn't proportionate under the Act.
• Too infrequent. Risks change with new markets, new agents and new guidance. When someone asks when the program was last updated, "January 2023" is an uncomfortable answer.

Traditional training vs microlearning

Here is how a microlearning approach to compliance training differs from the annual module.

Delivery factor		Annual module
Lesson length	Microlessons of about 5 minutes	Often 45-90 minutes in one sitting
Completion	95%+	Left to individual deadlines
Automatic enrollment and reminders	✓	✕
Completion tracking	100% compliance tracking	Often manual spreadsheets
Content updates	Kept up to date as regulations change	Depends on whoever owns the file

The question that matters is which approach gives you the evidence you need if the SFO calls. That is a different question from which one looked better in the procurement pitch.

How to build a program the SFO won't question

These six steps follow the Bribery Act principles and the direction of the SFO's 2025 guidance.

1. Write down your bribery risk assessment

   Put it on paper or in a system you can produce on request. Cover the markets you operate in, which roles deal with third parties or public officials, which spend categories are most exposed, and any local practices that add risk. This assessment justifies your training design.

2. Define your training tiers in writing

   Use the risk assessment to set general awareness for everyone and enhanced training for higher-risk roles. Record which job titles sit in which tier and why. That record is your evidence of proportionality.

3. Use current content

   Anything written before September 2025 should be checked against the ECCTA changes and the Crime and Policing Act 2026. If you can't say who reviewed the content and when, you can't show it's current. Look for providers that keep content up to date as regulations change.

4. Track completion automatically

   Completion is evidence. Log who finished what and when. Manual tracking leaves gaps, and gaps are what an investigator will find first.

5. Review after material changes, not just annually

   New markets, acquisitions, new third-party relationships, regulatory changes and internal incidents should all trigger a review. If you haven't checked your program against the November 2025 SFO guidance, now is a good time.

6. Make sure the board isn't exempt

   Senior leader participation evidences top-level commitment. If the CEO, CFO and non-executive directors are quietly excused, that gap is visible, and it tells everyone else how seriously the organization takes the topic.

How 5Mins delivers anti-bribery training

5Mins is an AI-powered microlearning platform for compliance, leadership and role-based training. Its compliance catalog includes 500+ accredited compliance courses, with anti-bribery content among them. For anti-bribery specifically, four things matter to compliance and HR teams:

• Short lessons. Microlessons of about 5 minutes, each built around one idea, on iOS and Android, with course reminders by email, push, Slack and Microsoft Teams.
• Training by role. Assign different courses to different groups so higher-risk roles get targeted content and not the all-staff module.
• 95%+ completion. 5Mins delivers 95%+ completion, so your records reflect what people actually did.
• Records you can pull. Reporting & Insights shows completions by person and team, with audit log CSV export, e-signatures and certificates.

Auto-enrollment, automations and reminders mean the program keeps running without anyone chasing people by email. Browse the full compliance course catalogs to see what is available.

Conclusion

Anti-bribery training isn't optional in practice. It's a visible part of the adequate procedures defense, and with the SFO active, ECCTA in force and senior manager liability widening, the cost of weak evidence is going up.

Start with a written risk assessment, tier your training by role, keep content current, track completion automatically and include the board. A program built that way is easier to run and far easier to defend.

This article is general information, not legal advice. Check your specific obligations with a qualified lawyer. Information is accurate as of 5 November 2026.