Since 29 June this year, it has become considerably easier to hold companies criminally responsible. Under the new rules, if a senior manager of a company or partnership commits an offence while acting within their actual or apparent authority, the organisation itself is treated as having committed it too.
The change comes from section 250 of the Crime and Policing Act 2026 (CPA). Crucially, it applies to any criminal offence committed by a senior manager within the scope of their role, not just economic crime. For UK businesses, that is a significant shift with far-reaching consequences.
Who counts as a senior manager?
The senior manager test isn't new. It is unchanged from the Economic Crime and Corporate Transparency Act 2023 (ECCTA), which came into force in December 2023. What has changed is how many offences it now applies to.
Law firm Herbert Smith Freehills Kramer (HSF Kramer) explains that liability can arise from the actions of anyone with meaningful decision-making authority. The net isn't limited to board directors or people covered by an individual accountability regime. Heads of business units, divisional leads and senior operational managers could all be caught.
Osborne Clarke agrees that it will be a fact-specific question each time, and could extend to senior project managers, senior finance and HR staff, regional managers and divisional heads, among others. It also warns of real uncertainty over what counts as a "substantial part" of an organisation's activities, and over whether a person was acting within their authority.
How does a company become liable?
The company doesn't need to have authorised the criminal conduct. It is enough that the conduct falls within the usual scope of the manager's "apparent authority". HSF Kramer gives some examples:
A CFO who produces false statements about the company's finances
An HR manager who commits an immigration offence
A marketing director who signs off a campaign they know contains misleading claims about a product
The wider rules also don't distinguish between offences linked to business activity and personal wrongdoing. The risk for firms is that they could face prosecution wherever an offence can be tied back to the manager's role.
Offences committed abroad can also fall within scope, though the chance of a company being held responsible for a senior manager's overseas conduct is fairly small. Osborne Clarke notes that this only applies where all of the conduct takes place outside the UK, and where the company wouldn't itself have committed the offence had the conduct been attributed to it directly.
In practice, though, that limit is narrower than it sounds. Companies can already be prosecuted for various offences committed overseas where there is a close UK connection. A UK-incorporated company involved in bribery or a sanctions breach that happens entirely abroad is one example.
How can you protect your business?
There are practical steps you can take now to prepare:
Map who really holds authority. Review management structures across regions, offices and functions, focusing on who actually makes decisions rather than who has the grand title. Revisit this as your organisation evolves.
Review delegation frameworks. Check authority matrices, delegation arrangements and client engagement protocols. Apparent authority is a key concept here: informal or perceived authority counts, even if it was never written down.
Widen your risk register. It should now cover all criminal offences, not just financial crime.
Refresh your training. Go beyond economic crime, so senior staff understand the full reach of the CPA. Consider specific modules on insider dealing, conduct when dealing with government, and handling material non-public information.
Strengthen due diligence on senior staff. That means thorough vetting when people are recruited or appointed, plus ongoing monitoring of those in senior roles to spot behavioural, regulatory or integrity risks early.
Improve whistleblowing procedures. Make sure criminal risks are escalated and investigated, and that employees feel confident raising concerns.
Check your insurance and M&A due diligence. Build the CPA into your due diligence processes, and speak to your professional indemnity and directors' and officers' (D&O) insurers to confirm your cover extends to the broader range of offences now in scope.
Prepare for internal investigations. Update your protocols so investigation teams can quickly establish whether someone is a senior manager under the statutory definition. Given the risk of corporate liability, this analysis should be carried out under legal privilege, either by a well-defined internal team or by external counsel.
Source: Osborne Clarke
We're here to help
If these changes concern you, or you have wider questions about your business, please get in touch. We'll do everything we can to support you..
Share this post: