Introduction
The Crime and Policing Bill 2025 received Royal Assent on 29 April 2026, becoming the Crime and Policing Act 2026 (CPA). Enacted to rebuild public trust in policing, the CPA introduces significant reforms spanning areas including offensive weapons, stalking and public order, confiscation, and corporate criminal liability.
The provisions of the CPA related to corporate criminal liability, which come into force on 29 June 20261, represent one of the most significant developments in UK corporate criminal law in recent decades.
CPA: Serious crime and corporate criminal liability
The CPA equips law enforcement agencies with a range of new powers to tackle serious and organised crime. Particularly significant for businesses is section 250, which establishes corporate criminal liability where a senior manager commits any criminal offence while acting in the scope of their actual or apparent authority.
This is distinct from the position prior to the CPA whereby a company could only be held criminally liable for the actions of an individual where that individual was "the directing mind and will" of the organisation. Particularly within large or complex corporates, it was difficult in practice for law enforcement to meet this threshold. The CPA is therefore expected to make it significantly easier for organisations to be held accountable for the criminal actions of their people.
The Economic Crime and Corporate Transparency Act 2023: The first shift
The Economic Crime and Corporate Transparency Act 2023 (ECCTA) enables an organisation to be held criminally liable where a senior manager commits a specified economic crime. The definition of "senior manager" was expanded to take into account the individual's role, responsibilities, and managerial influence within the organisation, rather than job title alone2.
The CPA adopts the definition of "senior manager" from ECCTA. The definition of a "senior manager" will often extend beyond a company's board and most senior executives, encompassing others who have significant responsibility in relation to the running of the business, with enforcement agencies looking beyond titles to what an individual is actually doing within their role. This reflects the reality of modern company structures, where "directing minds" are distributed across multiple functions, and is likely to facilitate prosecutions that may not previously have been possible under the identification doctrine.
The CPA: A major expansion of liability
The CPA replaces sections 196 to 198 of ECCTA and represents a substantial expansion of corporate criminal exposure. It extends corporate criminal liability beyond economic crime to cover any criminal offence committed by a senior manager acting in the scope of their actual or apparent authority. This may include health and safety offences, sexual misconduct, and regulatory breaches, among others. Critically, liability may arise even where the senior manager acted outside any express authority granted by the company or in breach of the company's policies3.
International businesses are not exempt: where part of the offence, the victim, or relevant business activity has a UK connection, UK criminal liability may follow4.
Defences
Notably, the CPA does not replicate the "reasonable procedures" defence available under ECCTA's "failure to prevent fraud" offence. It is irrelevant whether the senior manager in question was expressly directed by the corporate to carry out the conduct in question, or whether the individual intended for the corporate to benefit from the criminality.
Under section 250, the only available defences are:
- all of the conduct constituting the offence occurred outside the United Kingdom; or
- the organisation would not commit the offence had that conduct been attributable to the organisation directly, rather than to the senior manager.
Penalties
Convicted companies face unlimited fines for most serious offences in addition to any sentence imposed on the individual offender. Furthermore, the CPA substantially overhauls the confiscation regime under the Proceeds of Crime Act 2002 (POCA), including reforms aimed at making it easier to calculate a defendant's benefit from crime, thereby enabling realistic, enforceable orders, and clarifying the requirements for restraint orders to make it easier to preserve assets during an investigation.
Comment
The introduction of new corporate criminal liability under both the ECCTA and CPA reflects an unequivocal intention to increase enforcement in this area. Companies must carefully consider how responsibility is delegated within the organisation with effective oversight; how decisions and processes are documented; and their approach to regulatory compliance (including cross-border compliance for international organisations). Despite the lack of "reasonable procedures" defence under the CPA, strong compliance frameworks remain an essential preventative measure and may be of assistance by way of mitigation or in the context of public interest considerations in the event of suspected criminality.
What companies should do now
Companies should now, if they have not already, be taking proactive steps to prepare, taking account of both the relatively new failure to prevent fraud offence under the ECCTA, which came into force in September 2025, and the corporate liability provisions of the CPA. The approach will vary depending on a corporate's sector(s) of operation, size and geographical footprint. The White Collar Crime and Investigations Team at Mishcon de Reya has deep experience and is well placed to assist with:
- Risk assessments and compliance policy review, drafting or enhancements;
- Training for senior managers and in-house risk and compliance teams;
- Conducting internal investigations where criminality or misconduct is suspected; and
- Representing companies under investigation by enforcement agencies.
Please do not hesitate to contact our White Collar Crime and Investigations team.