UK: Expansion of corporate liability to all criminal offences committed by senior managers

Introduction

For several years, UK legal and policy circles debated the extent of corporate criminal liability, with the Economic Crime and Corporate Transparency Act 2023 (“ECCTA”) introducing two new routes to liability for corporates for economic crimes.  These offences are the new corporate offence of ‘failure to prevent’ fraud (“FTPF”), as well as the ‘senior manager’ corporate offence for specific economic crimes.  These came into force on 1 September 2025 and 26 December 2023 respectively.

In an attempt to increase accountability for corporates even further beyond economic crime, the Crime and Policing Act 2026 (“Act”) provides for a wholesale expansion, allowing corporates to be held liable for all criminal offences committed by senior managers. In short, this is a major, and arguably revolutionary, shift in the UK criminal landscape for corporates.

This new corporate criminal offence comes into force on 29 June 2026.

Corporate criminal liability: what was the position?

Under common law, corporate liability for criminal offences was traditionally governed by a doctrine known as the ‘identification principle’, whereby the “directing mind and will” of the entity must commit the offence with the requisite state of mind to attract corporate liability. Under the identification principle, an organisation commits a criminal offence where an individual representing the company’s ‘directing mind and will’ possesses the mens rea (mental state) required for the offence.   This remains the common law position generally.

However, with the expansion and growing complexity of companies and their decision making processes, it became increasingly difficult to identify a company’s “directing mind and will”.

Therefore, ECCTA lowered this threshold in relation to economic crimes only. Through section 196 of ECCTA, companies became criminally liable if  a “senior manager” committed a specified economic crime offence while “acting within the actual or apparent scope of their authority”. The economic crime offences included sanctions, bribery and money laundering offences, among others.

How does the new corporate offence apply?

Section 250 of the Act extends the senior manager offence under ECCTA to all criminal offences in the UK, rather than being limited to specified economic crimes. The Act does not replace or amend the general common law identification doctrine but does repeal (and builds on) the provisions under s196 ECCTA which related only to economic crimes. 

The offence is set out in s250(1) of the Act:

Where a senior manager of a body corporate or partnership (“the organisation”) acting within the actual or apparent scope of their authority commits an offence under the law of England and Wales, Scotland or Northern Ireland, the organisation also commits the offence (subject to subsection (2)).

The definition of ‘organisation’ is wide, and includes bodies incorporated both inside and outside the UK and also extends to UK and overseas partnerships. This means that a ‘senior manager’ (as defined) of an overseas company who commits an offence which could be prosecuted in the UK (if, for example, some of the conduct occurred, or the victim was present in, the UK), may bring the organisation within scope of the new offence.

Unlike the existing ‘failure to prevent’ offences, there is no defence of ‘adequate procedures’ or ‘reasonable procedures’ available to organisations.  It also applies to all organisations, regardless of size.

Who is a ‘senior manager’?

The Act (s250(3)) retains the ECCTA definition of “senior manager”, being an individual “who plays a significant role” in:

• the making of “decisions about how the whole or a substantial part of the activities” of the organisation are to be managed or organised; or
• the “actual managing or organising of the whole or a substantial part of those activities”.

The explanatory notes to the Act state that this “covers any individual who falls within the definition irrespective of their title, remuneration, qualifications or employment status”. It may include employees, officers or third party consultants.

For the company to be liable, the senior manager must be acting within the “actual or apparent scope of their authority” at the time of their offence. This captures conduct “of a type that the senior manager was authorised to undertake, or which would ordinarily be undertaken by a person in that position”.

Financial services firms should ensure that they do not confuse the definition of ‘senior manager’ here with the Senior Managers Regime used for FCA purposes.  There may well be some overlap (and certain individuals may fall within both), but the two terms are applied differently.

How does this affect your business?

The new offence makes it far easier for companies across all sectors to be held liable for crimes committed by a senior manager.

Uncertainty remains as to who is caught within the definition of ‘senior manager’ and  which offences are caught within a senior manager’s actual or apparent scope of their authority. It is therefore theoretically possible that corporates could, for example, be held liable for an individual’s breaches of specific criminal provisions under the Data Protection Act 2018 or insider dealing, but it is less clear whether liability would be imposed for violence or sexual offences. For example, it is difficult to imagine a senior manager acting within the “actual or apparent scope of their authority” when carrying out a physical assault or battery. Contrast that to a situation of harassment or sexual assault by a senior manager in the workplace, particularly if that conduct becomes routine and systemic.

In anticipation of the new offence coming into force on 29 June 2026, corporates should act proactively to consider how they may be able to mitigate any risks posed by their senior managers.  Corporates may wish to consider the following:

• Risk Mapping - consider who may be classed as senior managers and which offences may be committed while acting within the “actual or apparent scope of their authority”. Many corporates will have already undertaken or will be in the process of undertaking this risk assessment in light of ECCTA as part of their ongoing financial crime risk assessment – this will need to be expanded to other risk areas;
• Due Diligence - undertake further due diligence before hiring or promoting senior managers, alongside ongoing monitoring of such individuals;
• Training - provide targeted and frequent training on offences for senior managers;
• Internal policies - strengthen internal policies on preventing and disciplining misconduct, including contractual obligations on senior managers (including third party consultants) to seek to ensure compliance; and
• Whistleblowing - enhance internal reporting mechanisms and whistleblower protections to promote a ‘speak up’ culture so any risks are quickly identified.