The Crime and Policing Act 2026 extends corporate criminal liability for senior managers to all criminal offences, raising enforcement risk for regulated firms

The Crime and Policing Act 2026 has introduced a significant expansion of corporate criminal liability in England and Wales. Section 250 of the Act, which came into force on 29 June 2026, replaces sections 196 to 198 of the Economic Crime and Corporate Transparency Act 2023 (ECCTA), which had previously extended corporate criminal liability to certain economic offences where a senior manager was involved. The new provision is broader in scope: under the 2026 Act, the senior manager attribution model, by which a company can be held criminally liable for an offence when it is committed by or consented to by a senior manager acting within the scope of their actual or apparent authority, now extends to all criminal offences, not merely economic crime. This is a material escalation of corporate liability exposure. Regulated firms are likely to be starting from a relatively advanced compliance base given existing FCA and PRA (Prudential Regulation Authority) requirements under the SMCR (Senior Managers and Certification Regime). Under SMCR, senior managers performing designated functions (SMFs) must be approved by the FCA or PRA, with responsibilities formally allocated. However, legal commentary notes that there is still work to be done to mitigate the risk of a criminal investigation under the new broader regime. Practitioners advising regulated firms have identified five key practical steps that firms should consider, including reviewing internal controls, updating senior manager responsibility maps, and assessing whether existing governance frameworks adequately capture the extended attribution risk.