Can senior managers make their organisations criminally liable?

Since 29 June 2026, companies and partnerships (including LLPs) can now face criminal liability where a senior manager commits an offence while acting within the actual or apparent scope of their authority. The change is significant because it is not limited to fraud or bribery. In principle, it can apply to any criminal offence capable of being committed by an organisation.

This is one of those legal changes that could potentially have very real consequences. It changes how investigators and prosecutors can view wrongdoing inside a business. Instead of asking only whether the individual was the organisation’s “directing mind and will”, attention can now focus on whether they were a senior manager and whether they were acting within their authority at the time.

What has changed under the Crime and Policing Act 2026?

Section 250 of the Crime and Policing Act 2026 states that:

‘Where a senior manager of a body corporate or partnership (“the organisation”) acting within the actual or apparent scope of their authority commits an offence under the law of England and Wales, Scotland or Northern Ireland, the organisation also commits the offence.’

This wording is important. “Actual authority” usually means the authority the person has been given. “Apparent authority” is broader. It is about what the person appeared to be authorised to do from the outside, or how the organisation allowed the role to operate in practice.

The change applies to companies and partnerships, including limited partnerships. Where a partnership is prosecuted, proceedings are brought in the partnership’s name, and any fine is paid from partnership assets.

Who counts as a senior manager?

A senior manager is someone who plays a significant role in deciding how the whole, or a substantial part, of the organisation’s activities are managed or organised. It can also be someone who actually manages or organises the whole, or a substantial part, of those activities.

In real life, that often includes directors, chief financial officers (CFOs), and chief operating officers (COOs). But businesses should not assume the definition stops at board level. A head of HR, regional operations lead, compliance director, transport manager, finance lead or senior project manager could potentially fall within the definition if they have significant influence over a substantial part of the organisation.

So, the job title is not the test; what matters is what it is in reality. What does the person actually do? What decisions do they make? What authority does the business give them?

Why does this matter for business owners and directors?

One main issue is that corporate criminal liability will now be easier to establish in a wider range of cases. It is no longer just an economic crime issue. Depending on the facts, the risk could arise in areas such as health and safety, environmental regulation, transport, trading standards, food safety, data protection, licensing or other regulated activity.

For example: if a finance director were, say, to deliberately give false information about the company’s financial position as part of their role, the company may also commit the offence. The business does not need to have approved the conduct. It may not even have benefited from it. What matters is whether the senior manager committed the offence while acting within the scope of their authority.

That can feel uncomfortable for well-run businesses. Many organisations have sensible policies, training and reporting lines. Those steps still matter, but there is no general “adequate procedures” or due diligence “all reasonable steps” defence built into this provision.

Is there a defence if the business had good compliance procedures?

Not in the straightforward way that many directors might expect. Good compliance procedures are not, by themselves, a complete statutory defence to this form of liability. That does not make them irrelevant. Far from it.

Prosecutors will still have to consider whether there is enough evidence and whether prosecution is in the public interest. A business that can show proper risk assessments, training, escalation routes, supervision and a serious culture of compliance will usually be in a stronger position when making representations to an investigator or prosecutor.

What should businesses do now?

This is a good moment to review how authority is delegated and recorded. Who can make decisions? Who signs off high-risk activity? Who receives reports when something has gone wrong? And does the day-to-day reality match the organisation chart?

It may be wise to review senior management responsibilities, provide refresher training, check whistleblowing arrangements, consider incident response procedures, and ensure compliance concerns are escalated quickly. It may also be sensible to review risk assessments again and document why particular controls are considered adequate. This is where the paper trail matters. There must be cultural buy-in too.

How might this develop?

How widely prosecutors use this new route remains to be seen. In practical terms, it is likely to be developed and tested case by case, particularly around what counts as a “substantial part” of the business and whether the individual was acting within their apparent authority.

For now, the sensible approach is not to panic, but not to ignore it either. The change gives investigators another way to connect senior management misconduct to the organisation itself. Businesses that understand where authority really sits will be better placed to manage that risk.

Contact our regulatory and crime solicitors today

If you have any questions regarding any of the issues raised in this article, please do not hesitate to contact our specialist Regulatory & Crime team by using our online enquiry form or by calling 0330 191 5713.