The Crime and Policing Act 2026: A new dimension of corporate criminal liability

Receiving Royal Assent on 29 April and enacted on 29 June 2026, the Crime and Policing Act 2026 (‘the CPA 2026’) has been established to rebuild public trust in policing and ensure that the police and the courts have the powers necessary to tackle serious and organised crime.

Whilst the CPA 2026 includes provisions on numerous types of crimes, including sexual offences, criminal exploitation and stalking, its “provision about the criminal liability of bodies” is particularly relevant for organisations, as it represents a fundamental change to how corporate conduct will be regulated in the UK.

This is largely due to its reform of the ‘identification doctrine’, the mechanism by which the actions of an individual contribute to the criminal liability of a corporate entity.

Historically, corporate criminal liability has often depended on the common law “identification doctrine”. Under that doctrine, prosecutors generally had to show that the individual who committed the offence represented the company’s “directing mind and will”.

Whilst this is relatively straightforward to establish in small or micro businesses with simple hierarchical structures, it becomes more problematic when applied to modern, complex corporate structures, such as those of large, multi-national organisations. This is because decision-making and direction are often shared across business units, committees and management structures.

As a result, prosecutors could face real difficulty attributing criminal conduct to a large corporate, even if an individual has significant authority within one unit or department of that organisation. This creates an uneven playing field between large organisations and small businesses, as it is often easier to pursue prosecutions for corporate criminal liability against the latter.

The introduction of the Economic Crime and Corporate Transparency Act 2023 (‘ECCTA’) began to address that issue by introducing a broader attribution test for certain economic crimes.

Under section 196 of ECCTA, an organisation could now be held criminally liable for certain offences committed by a senior manager whilst acting within their actual or apparent authority. Those offences included areas such as fraud, bribery, false accounting, money laundering and sanctions related offences. 

The key development was the move away from the narrower “directing mind and will” test towards a broader “senior manager” test. That test focuses on the substance of an individual’s role and influence within the organisation, rather than their job title alone.

However, ECCTA was limited. It only applied to specific economic crime offences. The Crime and Policing Act 2026 now goes considerably further.

You can read more in-depth discussions on ECCTA and its implications for businesses via our dedicated web page here.

The CPA 2026 aims to extends the senior manager attribution model across the wider criminal law.

Section 250 of the CPA 2026 introduces this change, stating that, “where a senior manager of a body corporate or partnership (“the organisation”) acting within the actual or apparent scope of their authority commits an offence under the law of England and Wales, Scotland or Northern Ireland, the organisation also commits the offence.” This means that the circumstances in which organisations may face criminal liability has been significantly widened. 

The CPA 2026 adopts the definition of a senior manager as set out in the Corporate Manslaughter and Corporate Homicide Act 2007.

This covers anyone who has a significant role in “the making of decisions about how the whole or a substantial part of its activities are to be managed or organised” or who is responsible for “the actual managing or organising of the whole or a substantial part of those activities.”

Importantly, this is a functional test. It is not limited to statutory directors, board members or those with ‘chief’ in their job title. The assessment will be fact specific, with key questions being what the individual actually does, the authority they exercise, and the significance of the area of the business they manage.

The senior manager does not need to have been authorised to commit a criminal offence. The relevant question is whether the conduct was carried out while the individual was acting within the actual or apparent scope of their role.

Unlike the ‘failure to prevent’ offences under the Bribery Act 2010 and ECCTA, s.250 of the CPA does not create a defence based on having “reasonable” or “adequate” procedures in place.

Under section 250 of the CPA 2026, an organisation can only avoid corporate criminal liability if “all of the conduct constituting the offence occurs outside the United Kingdom” and “the organisation would not commit the offence if that conduct were the organisation’s (rather than the senior manager’s).”