Further Expansion Of Corporate Criminal Liability: Crime And Policing Bill

The proposed Crime and Policing Bill (the Bill) represents the next stage in the expansion of corporate criminal liability in the UK, building on the changes already introduced by the Economic Crime and Corporate Transparency Act 2023 (ECCTA).

Among other changes, ECCTA expanded the so‑called "identification doctrine" by introducing a new basis for attributing criminal liability to companies for the actions of their "senior managers". Under s.196 of ECCTA, a company can be held criminally liable if one of its senior managers commits an "economic crime offence" (as listed in Schedule 12 of ECCTA) while acting within the actual or apparent scope of their authority. This provision came into force in October 2023.

The Bill now proposes to extend s.196 of ECCTA so that it covers all offences and is no longer limited to specified economic crimes. This would represent a further significant change to corporate criminal liability in the UK, if the Bill is introduced in its current form.

The Bill is currently at the Report Stage in the House of Lords and is expected to be given Royal Assent later this year.

Pre-ECCTA Starting Point: The Identification Doctrine

Historically, corporate criminal liability in the UK was based on a relatively restrictive understanding of the identification doctrine. A company could only be held criminally liable if the individual who committed the offence was sufficiently senior to be regarded as the company's "directing mind and will". In practice, this typically meant board‑level directors or those exercising ultimate control.

Authorities argued that this doctrine made it too difficult to prosecute corporates successfully, particularly large organisations with complex governance structures. There were challenges where decision making authority was fragmented, and it was difficult to attribute the requisite mental element to the company itself. Prosecutions of large corporates for serious criminal wrongdoing were therefore relatively rare. We have considered these topics in our earlier briefings¹.

ECCTA: The Introduction of Senior Manager Attribution

ECCTA changed this landscape. It amended the law so that where a "senior manager" of a body corporate or partnership commits a relevant economic crime offence while acting within the actual or apparent scope of their authority, the organisation itself commits the offence. The concept of "senior manager" is broader than the traditional directing mind and will test, and captures individuals who play a significant role in managing or organising the whole, or a substantial part, of the organisation's activities.

Determining who is a senior manager in the relevant context will involve consideration of the individual's decision making power, as opposed to their job title alone. In many businesses, this could include divisional heads, regional leaders, or senior functional executives, in addition to directors and other senior officers.

Significant Features of Senior Manager Attribution

In addition to senior manager attribution, ECCTA introduced a new corporate offence of Failure to Prevent Fraud (FTP Fraud) under s.199 of ECCTA, which came into force in September 2025. This broadly follows the model of existing "failure to prevent" offences in relation to bribery and the facilitation of tax evasion (see our briefing here). It is instructive to consider senior manager attribution alongside that, by way of comparison.

One of the most significant features of senior manager attribution is that there is no requirement to show that the offence was intended to benefit the organisation, nor exclusion for liability where the company was itself an intended or actual victim of the offence. Under FTP Fraud, liability arises only where a specified fraud offence is committed with intent to benefit the organisation (or its clients) and is specifically excluded where the organisation itself was, or was intended to be, a victim of the fraud offence. By contrast, under s.196 of ECCTA, the company may be criminally liable even if the misconduct was for the senior manager's personal gain or the organisation derived no financial or strategic benefit. The company also may be liable even if the conduct was contrary to internal policy or governance frameworks.

Unlike the FTP Fraud offence (which only applies to large organisations), the senior manager attribution model applies to companies of all sizes. The jurisdictional scope is also broad, capturing organisations incorporated overseas. Extraterritorial conduct may also be captured, provided the company could itself be liable for the offence. In other words, liability will not attach to an overseas organisation for conduct carried out wholly overseas, simply because the senior manager concerned was subject to the UK's extraterritorial jurisdiction, e.g. as a result of their British citizenship. For example, if a UK senior manager committed an offence under the UK's sanctions regime against Russia (which offences generally apply to all persons in the UK and to UK persons anywhere in the world) entirely overseas, a UK‑incorporated company could be liable because the company could itself have committed that offence abroad. However, were a UK senior manager of an overseas‑incorporated company to commit the same offence with no UK conduct, the individual may be personally liable by virtue of their British citizenship, but the overseas company would not incur corporate liability because it could not have committed the offence in those circumstances.

The reforms are also distinct from the FTP Fraud offence as there is no corresponding "reasonable procedures" defence to the expanded identification doctrine

S.196 of ECCTA came into force at the end of 2023 and is as yet untested in the Courts. It will be instructive to see how it is used in practice, including who is identified as a "senior manager", how "acting in the apparent scope of their authority" is considered in practice, and whether the offence is in fact prosecuted in circumstances where there was no intended or actual benefit for the company.

Crime and Policing Bill: Expansion beyond Economic Crime

The Bill proposes to broaden the application of senior manager attribution beyond its current economic crime focus to all criminal offences. This may in some cases make it easier to bring prosecutions where this may not previously have been possible.

Potential areas of additional exposure include:

• health and safety (e.g., where a senior manager knowingly authorises unsafe systems of work that amount to a criminal breach);
• environmental regulation (e.g., where a senior manager approves unlawful discharges, emissions or disposal practices);
• workplace misconduct (e.g., where a senior manager engages in criminal conduct connected to their managerial functions, such as abuse of authority over employees); and
• offences under modern slavery legislation, insider dealing, and data protection offences where senior management involvement can be shown.

It is noteworthy that Deferred Prosecution Agreements (DPAs) are only available to a corporate in respect of specified offences under Schedule 17 of the Crime and Courts Act 2013, and that list is presently limited to certain economic crimes. DPAs will not, therefore, be available for the broader offences captured by the Bill's expansion, unless Schedule 17 is also expanded. Such an expansion has not yet been tabled, and we assume lawmakers would be cautious to do so.

Practical implications

Companies should give thought to their risk exposure, and relevant policies and procedures, in light of the Bill's proposed amendments to ECCTA. Liability may arise without board knowledge or any intended corporate benefit and, if the Bill is enacted, across a much wider range of offences. The assessment of risk posed by senior managers should therefore not be confined to economic crime but should encompass environmental compliance, workplace conduct, data protection, supply chain practices and all areas where senior managers exercise meaningful operational authority. While there will be an element of prosecutorial discretion, which may be particularly relevant where the organisation is the victim of such conduct, this provides little certainty.

Some companies may ultimately conclude that their existing systems and controls appropriately mitigate the risk of them being held criminally liable for the actions of their senior managers. For example, for organisations in the regulated sector, many senior managers may be subject to individual accountability regimes, including in respect of non-financial misconduct, which mean that robust risk assessment and mitigation frameworks are already in place. Equally, the scope of s.196 of ECCTA may be broader than those individual accountability regimes, both in terms of who may be considered as a "senior manager", and the range of conduct which may be relevant.

All companies must appreciate the broader circumstances where actions of their senior managers may create criminal liability for the organisation, and that this is set to expand further.

¹ 'Reforming Corporate Criminal Liability: The Law Commission's Options Paper' (15 June 2022) and 'No "directing mind and will" found in SFO prosecution of Barclays' (5 May 2020)

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.