Section 250 of the Crime and Policing Act 2026: An Expansion of Corporate Criminal Liability in the UK

On 29 April 2026, the Crime and Policing Bill 2025 received Royal Assent, bringing into law the Crime and Policing Act 2026 (the “Act”). Section 250 of the Act represents a watershed moment for UK corporate criminal liability, extending the “senior manager” attribution test, previously confined to specified economic crimes, to all criminal offences under the law of the UK. With s.250 having come into force on 29 June 2026, the range of individuals whose conduct can trigger a corporate prosecution has materially expanded.

Key Takeaways

1. 250 extends corporate criminal liability beyond economic crime to encompass all criminal offences committed by a “senior manager” acting within the actual or apparent scope of their authority.
2. There is no statutory “adequate procedures” defence available to organisations under this provision, unlike the failure-to-prevent bribery offence under the Bribery Act 2010, the failure to prevent facilitation of tax evasion offence under the Criminal Finances Act 2017, or the failure-to-prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023 (“ECCTA”).
3. The provision applies to organisations of all types and sizes, not just “large organisations”.
4. “Senior manager” attribution under s.250 is not confined to misconduct that benefits the organisation in question, albeit we question, where it is the victim, whether the corporate would be prosecuted.
5. No changes have yet been made to the deferred prosecution agreement (the “DPA”) regime to align it with the expanded scope of s.250, creating a significant gap in the resolution framework for newly in-scope offences.
6. Businesses should therefore consider

• • Reviewing their senior manager exposure;
  • Expanding risk assessments beyond economic crime;
  • Reviewing governance and delegation frameworks; and
  • Refreshing training programmes for senior managers.

Background

The attribution of criminal liability to corporate organisations in the UK is a complex area of law that depends on the nature of the offence. There are strict liability offences with no defences at all, strict liability offences with a due diligence defence, and offences for which the court determines corporate criminal liability by applying the rules of attribution.

In Tesco v Nattrass [1972] AC 153, the court applied the common-law “identification doctrine”, under which an individual’s conduct and mental state could only be attributed to a company if that individual constituted the organisation’s “directing mind and will”. The Privy Council in Meridian Global Funds Management Asia Ltd v Securities Commission [1995] UKPC 5 subsequently held that a special rule of attribution may be needed where limiting attribution to the board or true directing mind would frustrate the underlying statute’s purpose. In practice, save where the approach in Meridian applied, which was itself subject to much uncertainty, the courts interpreted the rules of attribution narrowly, typically requiring involvement of the board of directors, or a board committee with delegated authority, making it extremely difficult to hold large companies with complex governance structures accountable for alleged crimes committed by their personnel.

Parliament responded to these limitations by creating statutory “failure to prevent” offences. Section 7 of the Bribery Act 2010 established a strict liability offence for the failure to prevent bribery, but which was subject to a defence of “adequate procedures”. This model was subsequently extended to the facilitation of tax evasion and fraud.

Section 196 of ECCTA, which came into force in December 2023, represented a further fundamental shift by establishing a new basis for corporate criminal liability whereby an organisation could be held criminally liable where a “senior manager” committed certain economic crimes, including fraud, money laundering, bribery, and tax evasion, while acting within the actual or apparent scope of their authority.

Section 250 of the Act

S.250(1) of the Act now broadens the “directing mind and will” test. It provides that where a senior manager of any body corporate or partnership (the “organisation”), regardless of size, acting within the “actual or apparent scope of their authority” commits an offence under the laws of the UK, the organisation also commits that offence. The provision repeals and replaces s.196 of ECCTA and applies the same “senior manager” attribution model but removes any restriction as to the category of criminal offence. S.250 therefore exposes organisations to potential criminal liability across the full spectrum of criminal offences, including offences under data protection, computer misuse, modern slavery, environmental, health and safety, and competition legislation, as well as market abuse regulation (to the extent of criminal market manipulation).

“Senior manager” is defined under s.250(3) as including an individual who plays a significant role either in: (a) the making of decisions about how the whole or a substantial part of the organisation’s activities are to be managed or organised; or (b) the actual managing or organising of the whole or a substantial part of those activities. In practice, this category can extend beyond the formal board of directors to encompass operational managers, regional heads, and other individuals who exercise actual or apparent decision-making authority for the misconduct in question.

Critically, unlike the failure-to-prevent offences, senior manager attribution under s.250 is not confined to misconduct that benefits the organisation. There is no legal restriction on a corporate prosecution being brought even where the organisation is harmed by, or is itself the victim of, the offending conduct, although any such prosecution would still need to be in the public interest, in accordance with the Code for Crown Prosecutors. In addition, s.250 does not include a statutory defence of having in place adequate or reasonable procedures to mitigate the risk of misconduct.

The corporate liability provisions of the Act came into force on 29 June 2026. The joint Crown Prosecution Service/Serious Fraud Office corporate prosecution guidance is expected to be updated in due course to address the practical application of s.250 to the newly in-scope offences, as was done following the introduction of section 196 of ECCTA. It also remains to be seen whether the Government will expand the DPA framework under the Crime and Courts Act 2013 to encompass the broader range of offences now attributable to organisations under s.250.

Prosecutorial authorities will nonetheless still face material challenges in bringing successful prosecutions under s.250, as the “senior manager” test remains untried in the courts, and the “decision-making” and “actual managing or organising” limbs of the test are sufficiently unclear to enable legal and factual challenges from defendants.

Next Steps

In light of s.250, organisations should consider taking the following steps:

• Review senior manager exposure. Identify all individuals who may qualify as a “senior manager” under the functional statutory definition by reference to the actual decision-making authority exercised in practice. This exercise should extend to operational managers, regional heads, and any individual who in practice manages or organises a substantial part of the organisation’s activities. This is because s.250 applies corporate criminal liability based on the conduct of senior managers, and the statutory definition is broader than traditional board-level roles. Without a clear understanding of who falls within this category, an organisation will not be able to effectively assess its exposure or implement targeted risk mitigation measures.
• Expand risk assessments beyond economic crime. Group-wide criminal risk assessments should be extended to cover areas including health and safety, environmental compliance, data protection, modern slavery, employment law, and competition law, with particular focus on areas where senior managers exercise material discretion and authority. Unlike s.196 of ECCTA, which was limited to specific economic crimes, s.250 removes any restriction as to the category of criminal offence. Organisations that have previously focused their compliance efforts on bribery, fraud, and money laundering must now consider the full spectrum of regulatory offences to which criminal liability may now attach.
• Review governance and delegation frameworks. Organisations should review delegation matrices, approval rights, committee terms of reference, and job descriptions to ensure they accurately reflect how decisions are taken in practice. Given the focus on “apparent” as well as actual authority, it is essential that internal governance arrangements correspond to operational reality. A disconnect between formal governance documents and day-to-day practice could inadvertently expand the pool of individuals whose conduct may be attributed to the organisation or create ambiguity that complicates any subsequent defence.
• Refresh training programmes. Training for boards and senior management should be updated to reflect the breadth of offences now capable of triggering corporate criminal liability and should extend well beyond traditional financial crime risks. Given that s.250 does not include a statutory defence of adequate procedures, training cannot provide a complete safe harbour. However, demonstrable investment in compliance culture and awareness may be relevant to prosecutorial discretion, sentencing, and any subsequent regulatory proceedings.

Click here to download this article.