New UK Legislation Expands Corporate Criminal Liability

A sweeping expansion of corporate criminal liability in the United Kingdom poses consequences for companies with cross-border operations, as Jenner & Block writes in an article on its website.

The Crime and Policing Act 2026, which will take effect June 29, holds companies responsible for criminal conduct committed by senior managers acting within the scope of their authority, regardless of whether the company benefited or how robust its compliance program is.

The legislation marks the most significant shift in this area of English law in decades.

English law historically confined corporate criminal liability to conduct by the so-called “directing mind and will,” essentially board-level officers whose actions could be legally identified with the company itself. That narrow standard made prosecutions of large, complex organizations difficult.

The Economic Crime and Corporate Transparency Act 2023 began loosening that framework by introducing a broader “senior manager” attribution model, but only for financial crimes such as fraud, bribery, and money laundering. The new legislation removes that limitation entirely.

The Crime and Policing Act 2026 extends the senior manager attribution model to all criminal offences, from computer access violations to environmental and public safety crimes. The statute defines “senior manager” functionally rather than by title, capturing anyone playing a significant role in managing a substantial portion of company activities.

No compliance defense is available, and extraterritorial reach is meaningful. Liability can attach when a substantial measure of unlawful conduct occurs in England or Wales, even if the offense is not completed there. Companies are advised to map senior manager populations, broaden risk assessments, refresh codes of conduct, and implement targeted training.

Enterprise risk management frameworks require immediate recalibration given the statute’s functional definition of senior manager and the absence of a compliance defense. Board governance and fiduciary duties are implicated as directors must ensure the organization identifies exposure across all business functions, not just financial crime.

Companies with cross-border operations should assess jurisdictional risk carefully, given the Crime and Policing Act’s extraterritorial provisions.