UK Corporate Criminal Liability: New 'Failure to Prevent' Offences & Risks

The Expanding Net of UK Corporate Criminal Liability: A New Era of Accountability

The landscape of UK Corporate Criminal Liability has undergone a seismic shift with the recent enactment of the Crime and Policing Act 2026 (CPA 2026). This landmark legislation significantly broadens the scope under which organisations can be held criminally responsible for the actions of their senior managers, moving far beyond the specific economic crimes previously targeted by the Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023).

For UK accounting and bookkeeping practices, this represents a critical development. The 'failure to prevent' principle, initially applied to bribery and later expanded to fraud, now extends to virtually any criminal offence committed by a senior manager acting within their authority. This blog post will delve into these profound changes, outlining the heightened risks for practices and detailing the essential steps required to ensure robust compliance and mitigate potential liabilities.

Understanding the Economic Crime and Corporate Transparency Act (ECCTA) Foundation

Before the CPA 2026, the primary route for corporate criminal liability in the UK was often the challenging 'identification doctrine'. This required prosecutors to prove that the individual committing the crime was the 'directing mind and will' of the company, a high bar to clear, especially for large, complex organisations.

The Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023) began to address this by introducing two key reforms:

Senior Manager Attribution for Economic Crimes: Section 196 of ECCTA 2023 modified the corporate criminal attribution rules for a specified list of economic offences (including fraud, bribery, money laundering, and financial sanctions offences). It allowed a corporate organisation to be liable where a 'senior manager' committed one of these offences while acting 'within the actual or apparent scope of their authority'. This provision came into force on 26 December 2023.
The 'Failure to Prevent Fraud' Offence: Separate from the senior manager attribution, ECCTA 2023 also created a new corporate criminal offence of 'failure to prevent fraud' (Sections 199-206 and Schedule 13). This offence, effective from 1 September 2025, applies to large organisations. An organisation can be held criminally liable if an 'associated person' (e.g., an employee, agent, or subsidiary) commits a specified fraud offence intending to benefit the organisation (or a client), and the organisation did not have reasonable fraud prevention procedures in place.

Key takeaway: The 'failure to prevent fraud' offence is a strict liability offence with a 'reasonable procedures' defence, specific to fraud. The senior manager attribution under ECCTA 2023 was limited to *economic* crimes.

The Crime and Policing Act 2026: A Paradigm Shift in Corporate Accountability

The Crime and Policing Act 2026 (CPA 2026), which received Royal Assent on 29 April 2026, represents the most significant expansion of corporate criminal liability in recent UK history. Coming into force for offences committed on or after 29 June 2026, the CPA 2026 takes the senior manager attribution principle established in ECCTA 2023 and applies it universally.

This means that a company can now be held criminally liable for any criminal offence committed by a 'senior manager' acting within the actual or apparent scope of their authority. This is a profound shift from the previous focus on specific economic crimes, casting a far wider net over corporate activities.

No 'Reasonable Procedures' Defence for All Crimes

Crucially, unlike the 'failure to prevent' offences for bribery, tax evasion, and fraud, the CPA 2026's expanded senior manager attribution for *all* crimes does not include a statutory defence of 'reasonable procedures'. If a senior manager commits an offence within the scope of their authority, the organisation itself may be found guilty, irrespective of its prevention efforts. This places an even greater onus on proactive prevention and robust internal controls.

Who is a 'Senior Manager' Under the New Regime?

The definition of a 'senior manager' is critical and is functional rather than title-based. It captures individuals who play a significant role in:

The making of decisions about how the whole or a substantial part of the organisation's activities are to be managed or organised.
The actual managing or organising of the whole or a substantial part of those activities.

This definition is deliberately broad and can extend beyond traditional board members or top-tier executives. It could include heads of departments, regional managers, or anyone with genuine decision-making power over a significant part of the business. Accounting practices must carefully identify such individuals within their structure, as their actions can now directly implicate the firm.

Heightened Risks for UK Accounting Practices

The expanded UK Corporate Criminal Liability under the CPA 2026 presents significant new challenges and risks for accounting and bookkeeping firms. Your firm could face prosecution if a senior manager commits a criminal offence, even if it's not directly for the firm's benefit, as long as it's within their actual or apparent authority.

Consider the following scenarios where an accounting firm's senior manager could trigger corporate criminal liability:

Data Protection Breaches: A senior manager unlawfully obtains, discloses, or retains client personal data, or alters information to prevent disclosure to a data subject, in violation of the Data Protection Act 2018.
Computer Misuse: A senior manager gains unauthorised access to client systems or internal firm data, or performs unauthorised acts causing damage, as defined by the Computer Misuse Act 1990.
Environmental Offences: If an accounting firm owns property or manages facilities, and a senior manager's actions lead to an environmental offence (e.g., unlawful waste disposal), the firm could be liable.
Health and Safety Violations: Systemic breaches of health and safety regulations, authorised or tolerated by senior management, could lead to corporate criminal charges.
Facilitation of Other Crimes: While the 'failure to prevent fraud' offence covers specific fraud, the broader CPA 2026 could capture senior managers facilitating other criminal activities, even if not directly benefiting the firm, if done within their scope of authority.

Beyond the direct criminal offence, accounting firms face substantial fines, reputational damage, director disqualifications, and even restrictions on trading. This also intensifies scrutiny around existing obligations like AML compliance and client due diligence, as any failures could be compounded by the new liability framework.

Practical Steps for Mitigating New Corporate Criminal Liability Risks

Given the expanded scope of UK Corporate Criminal Liability, accounting practices must act decisively to review and enhance their compliance frameworks. The effective date of 29 June 2026 for the CPA 2026 means that time is of the essence.

1. Comprehensive Risk Assessment and Mapping

Conduct a thorough, firm-wide risk assessment to identify areas where senior managers could potentially commit criminal offences within their actual or apparent authority. This should go beyond traditional financial crime risks to include areas like data security, environmental impact, and health and safety. Map out who qualifies as a 'senior manager' within your organisation, irrespective of their job title, and understand their scope of authority.

2. Review and Update Policies and Procedures

Existing policies and procedures must be reviewed and updated to reflect the broadened liability. This includes:

Internal Controls: Strengthen internal controls across all departments to prevent and detect criminal activity.
Ethics and Conduct Policies: Reiterate expectations for ethical conduct and zero tolerance for criminal behaviour, explicitly referencing the expanded corporate liability.
Whistleblowing Mechanisms: Ensure robust, well-communicated whistleblowing channels are in place and that reports are taken seriously and acted upon.
Data Governance: Enhance data protection policies and ensure compliance with GDPR and the Data Protection Act 2018 to mitigate risks related to data misuse by senior managers.

3. Mandatory Training and Communication

Implement mandatory, regular training for all staff, with a particular focus on senior managers. This training should cover:

The implications of the CPA 2026 and ECCTA 2023.
The definition of a 'senior manager' and their enhanced responsibilities.
Specific criminal risks relevant to the firm's operations (e.g., data protection, computer misuse, fraud).
The firm's updated policies, procedures, and reporting mechanisms.

Foster a culture of compliance where ethical conduct is paramount and concerns can be raised without fear of reprisal. Clear communication from top-level commitment downwards is essential.

4. Enhanced Due Diligence and Monitoring

Extend enhanced due diligence procedures to cover not only clients (as part of your AML compliance guide) but also third parties and internal senior managers. Continuous monitoring of activities and transactions is crucial to detect suspicious behaviour. This includes regular audits of internal systems and processes.

5. Leverage Digital Compliance Tools

Digital tools can significantly streamline and strengthen your compliance framework. Platforms designed for accountants can help manage:

Client Onboarding and AML Checks: Automate client due diligence, identity verification, and ongoing monitoring to flag suspicious activities effectively.
Policy Management: Centralise and distribute updated policies, ensuring all staff acknowledge and understand them.
Training Tracking: Monitor completion of mandatory training modules and identify areas for further education.
Risk Registers: Maintain dynamic risk registers that are regularly reviewed and updated to reflect evolving threats.
Audit Trails: Generate comprehensive audit trails to demonstrate 'reasonable procedures' where applicable (e.g., for 'failure to prevent fraud') and overall commitment to compliance.

While digital tools cannot eliminate risk, they provide the infrastructure for a proactive, auditable, and efficient compliance programme, crucial in demonstrating your firm's commitment to preventing criminal activity.

Conclusion: Proactive Compliance is Imperative

The Crime and Policing Act 2026 marks a fundamental and irreversible shift in UK Corporate Criminal Liability. The expanded 'senior manager' attribution for all criminal offences, effective from 29 June 2026, means that accounting practices can no longer afford to view corporate criminal liability solely through the lens of economic crime.

The absence of a 'reasonable procedures' defence for these broader offences underscores the urgency for robust, proactive measures. Firms must move beyond reactive compliance and embed a culture of integrity and vigilance at every level, starting with their senior management. Review your systems, train your teams, and consider how digital solutions can fortify your defences against this widening net of corporate accountability. Failure to do so could lead to severe penalties and irreparable damage to your practice's reputation.