Prosecutors no longer need to prove board-level “directing mind and will” involvement. The era of diffuse accountability is ending.
Introduction
One of the biggest shifts in UK corporate accountability in years has arrived quietly. Many UK and foreign firms may still not grasp the scale of the impact.
Introduced alongside wider policing and public safety reforms, the UK’s Crime and Policing Act 2026 may become one of the most consequential corporate liability shifts for financial institutions in decades.
Building on the Economic Crime and Corporate Transparency Act (ECCTA), the legislation fundamentally changes how criminal liability can be attributed to organisations.
This article explains what has changed, what it means for firms, and how to prepare.
The Old Law: The “Directing Mind and Will” Problem
Under the traditional common law principle of identification, a company could only be criminally liable if a person who was the “directing mind and will” of the company committed the offence.
The problem:
- In large organisations with diffuse decision-making, it was often impossible to identify a single “directing mind”
- Senior managers could commit offences without board-level involvement
- Prosecutors struggled to prove liability
- Companies escaped accountability
Result: Corporate criminal liability was difficult to establish, especially in large financial institutions.
The First Step: ECCTA (Economic Crime and Corporate Transparency Act)
ECCTA introduced the “senior manager attribution” model for economic crime offences.
What it did:
- Extended liability beyond the “directing mind and will”
- A company could be liable if a “senior manager” committed an offence within their authority
- Removed the need to prove board-level involvement for economic crime
Limitation: ECCTA applied only to economic crime (fraud, money laundering, etc.).
The Second Step: Crime and Policing Act 2026
The Crime and Policing Act 2026 extends the “senior manager attribution” model beyond economic crime to a much wider range of offences.
Key changes:
| Aspect | Old Law | New Law (2026) |
|---|---|---|
| Attribution | “Directing mind and will” (board-level) | Senior manager acting within authority |
| Offence scope | Limited (hard to prove) | Expanded across multiple offence types |
| Prosecution burden | High (proof of board involvement) | Lower (proof of senior manager action within authority) |
| Governance risk | Low (diffuse accountability) | High (senior manager actions = firm actions) |
Key Provisions of the Crime and Policing Act 2026
1. Extended Senior Manager Attribution
The “senior manager attribution” model now extends beyond economic crime to a much wider range of offences.
2. No “Directing Mind and Will” Requirement
Prosecutors no longer need to prove board-level “directing mind and will” involvement.
3. Liability for Actions Within Authority
Firms may face liability where a senior manager commits an offence while acting within their authority.
4. Broader Definition of Senior Manager
“Senior manager” is determined by influence and decision-making power – not simply title. This captures individuals who may not have board-level positions but exercise significant control.
5. Expanded Offence Scope
Exposure now extends beyond fraud and AML into:
- Conduct offences
- Sanctions violations
- Operational failings
- Wider governance risks
What This Means for Firms
The question is no longer: “Who approved it?”
The question is now: “Did the organisation exercise effective oversight and control?”
| Risk Area | Implications |
|---|---|
| Governance | Inadequate oversight can now be criminal |
| Compliance | Compliance failures by senior managers = firm liability |
| Conduct | Misconduct by senior managers = firm liability |
| Sanctions | Breaches by senior managers = firm liability |
| Operations | Operational failings caused by senior managers = firm liability |
Who Is a “Senior Manager”?
Under the new framework, “senior manager” is determined by:
- Influence: Does the individual have significant influence over decision-making?
- Authority: Does the individual have the authority to commit the firm to actions?
- Control: Does the individual exercise significant control over operations or compliance?
- Not title: Job titles are not determinative.
Examples of individuals who may qualify:
- Regional heads
- Business line heads
- Compliance officers with authority
- Senior traders
- Risk management heads
Practical Implications for Financial Institutions
1. Governance Must Be Real, Not Cosmetic
Boards cannot delegate responsibility and then claim ignorance. The firm is liable for senior manager actions within their authority.
2. Compliance Programs Must Be Enforceable
Having a compliance program is not enough. The firm must ensure senior managers comply with it.
3. Training Is Essential
Senior managers must understand that their actions are the firm’s actions. Individual liability and corporate liability are not mutually exclusive.
4. Documentation Matters
When a senior manager makes a decision, document the process, the rationale, and the oversight exercised. This may be crucial in defending against allegations.
5. Whistleblower Channels Must Work
Senior managers cannot silence whistleblowers. The firm has a duty to ensure that concerns are heard and addressed.
6. Audit Trails Are Critical
Every decision that carries compliance or conduct risk should have an audit trail. Who decided? What authority? What oversight?
Comparison with Other Jurisdictions
| Jurisdiction | Liability Model | Key Feature |
|---|---|---|
| UK (pre-2026) | Directing mind and will | Difficult to prosecute |
| UK (2026) | Senior manager attribution | Much broader liability |
| US | Respondent superior | Employer liable for employee acts within scope of employment |
| France | Sapin II | Mandatory compliance programs |
| Australia | Corporate criminal liability | Attribution based on employee conduct |
The UK is now closer to the US model, where corporate liability is much easier to establish.
The Timeline
| Event | Impact |
|---|---|
| ECCTA (previous) | Introduced senior manager attribution for economic crime |
| Crime and Policing Act 2026 | Extends attribution to wider range of offences |
| Enforcement expected | Prosecutors now have tools; expect cases within 12-24 months |
What Firms Must Do Now
Immediate steps:
- Identify senior managers under the new definition (influence and authority, not title)
- Assess governance gaps where senior manager actions could create liability
- Strengthen oversight mechanisms for senior manager decisions
- Document everything – decisions, authority, oversight
- Train senior managers on their personal and corporate liability exposure
- Review compliance programs – are they enforceable?
- Conduct risk assessments for conduct, sanctions, operational failings
Conclusion
The Crime and Policing Act 2026 represents a fundamental reset of corporate accountability in the UK.
Prosecutors no longer need to prove board-level “directing mind and will” involvement. Senior manager attribution now extends beyond economic crime to a much wider range of offences. Liability attaches where a senior manager commits an offence while acting within their authority.
The question is no longer “Who approved it?” but “Did the organisation exercise effective oversight and control?”
For financial institutions and other regulated firms, this may become one of the most consequential governance and conduct risk developments of the next decade.
Boards must act now.
QUIZ
Q: What was the traditional model of UK corporate liability? Ans: The “Directing Mind and Will” or Identification Principle.
Q: How is a “Senior Manager” defined under the 2026 Act? Ans: By functional influence and decision-making power, not just job title.
Q: Does the Act apply only to economic crimes? Ans: No, it extends to conduct offenses, sanctions violations, and operational failings.
Q: What is the primary defensive requirement for firms now? Ans: Exercising effective oversight and control over senior manager actions within their authority.
FAQ
Q: How does the Crime Policing Act 2026 differ from the ECCTA? Ans: While the ECCTA introduced senior manager attribution for economic crimes, the Crime Policing Act 2026 extends this model to a much wider range of offenses, including conduct and operational failings.
Q: Can a firm be liable if the board was unaware of the manager’s actions? Ans: Yes. The Act removes the requirement to prove board-level involvement, focusing instead on whether the senior manager acted within their authority.
Q: What is the most critical step for firms to take now? Ans: Firms must identify “Senior Managers” based on influence and authority and implement robust, documented oversight for their decision-making processes.
Adv. Shoeb Hakim
Corporate Criminal Liability & Governance Advisor
📌 Follow me on LinkedIn for daily corporate governance and criminal law insights: [Your LinkedIn Profile Link]
📌 Visit my website for more articles: www.shoebhakim.com
♻️ Share this article with your board, legal, and compliance teams.
Disclaimer: This article is for informational purposes only and does not constitute legal advice.
Hashtags: #CrimeAndPolicingAct2026 #CorporateLiability #CorporateCriminalLiability #UKLaw #Governance #Compliance #ECCTA #SeniorManagerAttribution #FinancialInstitutions #LegalReform #CorporateAccountability #ConductRisk #Sanctions #OperationalRisk #BoardOversight #DirectingMindAndWill #UKProsecution #SFO #FCA #PRA #EconomicCrime #CorporateGovernance #RiskManagement #ComplianceProgram #Whistleblower #AuditTrail #SeniorManager #CriminalLiability #LegalUpdate #AdvShoebHakim