The Crime and Policing Act 2026 (the "2026 Act") makes an important change to when organisations operating in the UK can be criminally liable for the actions of their ‘senior managers’. The new provisions come into force on 29 June 2026 and will extend far beyond the areas where courts have traditionally been ready to find organisations liable for the actions of senior individuals.
The new provisions mean that organisations must be focused on the prevention of a broad range of crimes within their business and supply chains. A robust compliance framework is the most effective way to do that.
The first significant change – economic crimes under ECCTA
Until recently, a company would only be held criminally liable for the acts of individuals who represented its ‘directing mind and will’. This typically applied to board members and the most senior executives.
The first significant change to this approach took place in December 2023 when section 196 of the Economic Crime and Corporate Transparency Act 2023 (“ECCTA”) came into force. This provided that a company would be criminally liable if a ’senior manager’ committed a specified economic crime offence while ‘acting within the actual or apparent scope of their authority’.
ECCTA signalled the beginning of a new era of corporate criminal liability, which could now be triggered by the actions of a wide range of senior employees. However, the scope of ECCTA is limited to economic crime offences such as fraud and bribery.
The next step – section 250 of the 2026 Act
The 2026 Act casts the corporate criminal liability net further than the listed economic crimes within ECCTA, and in so doing will make companies liable for a wider range of senior manager conduct.
However, there are limitations on the circumstances in which corporate criminal liability may arise. An organisation can only be criminally liable where a senior manager commits an offence while ‘acting within the actual or apparent scope of their authority’.
Organisations will not be liable where a senior manager commits an offence while engaging in conduct which has no connection to their role.
An organisation will be liable if the conduct is of a type that the senior manager was authorised to undertake or which would ordinarily be undertaken by a person in that position.
Who counts as a senior manager?
The definition of ‘senior manager’ in the 2026 Act is broad and includes those with a ‘significant role’ in:
- making decisions about how the whole, or a substantial part, of an organisation's activities are managed;
- making decisions about how the whole, or a substantial part, of an organisation's activities are organised;
- managing an organisation’s activities directly; or
- organising an organisation’s activities directly.
In practice, this will include individuals who do not sit at the boardroom table. Operational directors, divisional heads, and other individuals with genuine decision-making authority over a substantial part of a business's activities are all at risk of falling within scope.
How can organisations assess the risk?
Organisations will need to understand which individuals within their structures could be classified as senior managers in order to understand and manage their exposure. Many organisations have already carried out this exercise in response to the coming into force of section 196 of ECCTA, but that exercise was limited to individuals who were at risk of committing defined economic crimes.
With this restriction due to be removed, organisations must now consider the scope of the actual or apparent authority of all senior managers and consider the scope for criminal liability arising from that senior manager.
What can organisations do to mitigate the risk?
Unlike the ‘failure to prevent’ offences introduced by legislation such as the Bribery Act 2010, the Criminal Finances Act 2017, and most recently ECCTA - where a company may raise a defence of having prevention procedures in place - the extension of corporate criminal liability under the 2026 Act is not accompanied by equivalent statutory defences.
This means that prevention must be a priority. Organisations must ensure that they have robust compliance frameworks and internal controls which are effective in preventing criminal conduct by senior managers.
How can we help?
We regularly work with organisations across all sectors to develop and implement bespoke compliance frameworks. Our expertise enables us to help organisations understand where they may be exposed to criminal liability risks.
We can support your business with conducting organisation-wide risk assessments, training, and senior-manager identification. We can also assist with the implementation of controls tailored to the risks specific to your business, supply chains and sectors.
If you would like to discuss how these changes may affect your organisation, please contact Paul Marshall, Finlay Mackenzie, or your usual Brodies contact.
