Sally Clark

In April, the Crime and Policing Act 2026 received royal assent, further expanding the circumstances when businesses or organisations may be prosecuted for wrongdoing by senior staff.

When section 250 of the Act comes into effect later this month, a company or organisation could face prosecution for any offences – not just ‘economic crimes’ as per the previous legislation - carried out by a ‘senior manager’; a broadly-defined term of someone who plays a significant role in decision-making about the whole or a substantial part of an organisation’s activities, or in managing or organising those activities.

If criminal conduct can be linked to a qualifying senior manager acting within their “actual or apparent” authority, this new legislation will cover offences far beyond the normal range of business misconduct.

The removal of the ‘economic crime’ constraint will very likely widen the range of scenarios in which prosecutors can consider pursuing businesses or organisations, especially where the level of public interest is heightened by topical events or high-profile campaigns.

This could include environmental offences, such as knowingly causing or permitting polluting discharges, as well as computer misuse offences that could all be shown to have been authorised or directed by a senior manager.

Similarly, data protection violations and offences against the person, modern slavery and human trafficking offences, even attempts to pervert the course of justice could provide potential areas of prosecution if committed by a senior manager acting within the scope of their authority.

For most companies and organisations, the immediate risk of prosecution will be low, as senior managers very rarely commit crimes in the course of business or in their private lives. However, when incidents do occur, they are very high impact and it can be expected that some high-profile prosecutions are likely to emerge. This is especially likely in areas where previous prosecutions may have failed because they were unable to establish ‘directing mind and will’ in large, complex organisations.

The breadth of the new test presented by the Act is likely to change how boards and general counsel think about non-economic criminal exposure, especially across highly regulated or operationally complex industries.

Any early enforcement actions carried out under this new legislation are likely to generate test cases on how a senior manager is defined and the boundaries of their actual and apparent authority. Those decisions, in turn, could feed into risk registers, insurance underwriting, HR policies, directors’ duties, transaction diligence and other key features of the economic landscape.

Under the realm of the Crime and Policing Act, businesses and organisations with UK operations must now consider whether existing controls — often built around financial and economic crime — are calibrated for a wider set of criminal risks tied to decision-making and oversight by senior staff.

Among the practical areas for review are risk assessment and audit programmes, including how non-financial criminal risks are identified and escalated. Financial controls and due diligence, including whether existing anti-money-laundering procedures adequately cover corporate asset misuse and third-party risk, should also be given fresh scrutiny.

Along with insurance and critical incident response planning as well as training, monitoring and speak-up channels, further areas for review are governance and delegations of authority, including documentation and practical controls around who can bind a business or organisation and how ‘apparent authority’ is managed.

Sally Clark is an of counsel at CMS. This article first appeared in The Scotsman.