Chara de Lacey (Transparency International UK) || From 29 June 2026, UK legislation will hold companies liable for any criminal offence committed by a "senior manager" in the exercise of their actual or apparent authority. Alongside the new EU Directive on combating corruption (the Directive) — which establishes minimum standards, including the requirement for corporate criminal liability for corruption offences — corporate criminal liability regimes are expanding. With this comes increased legal risk for companies. How this affects compliance systems will be a key consideration for ethics and compliance professionals in the future.
The evolution of corporate criminal liability in the United Kingdom
The need to identify who within the company can be considered responsible for its actions is a historical feature of UK law. Until recently, this required identifying those who represent the "directing mind or will" of the company, that is, those who have been "entrusted with the exercise of the company's powers" (the identification doctrine).
Reforming the identification doctrine is something that Transparency International UK and others have long advocated, as it has proven difficult to hold a company accountable based solely on this test, particularly with the advent of decentralised decision-making.
The UK Bribery Act introduced a novel model of secondary liability through the offence of "failure to prevent", partly to address the limitations of the identification doctrine. This established the principle that a company has a legal obligation to prevent bribery by "associated persons", which are individuals and entities providing "services for or on behalf of" the company. As this is an offence of strict liability (without fault), prosecutors do not need to prove criminal intent, and company personnel do not need to authorise or even be aware of the bribery.
The "failure to prevent" model has proven to be a more effective tool for prosecutors and has been extended to other offences. However, the narrow identification doctrine has remained a barrier to direct liability. It was even determined that the CEO of a large company did not represent the directing mind or will of the company in a significant corporate fraud case in 2018.
In 2023, the Economic Crime and Corporate Transparency Act updated the legal trigger for direct liability, drawing inspiration from the "senior management" criterion of the Corporate Manslaughter and Corporate Homicide Act 2007, to make companies liable when a "senior manager [...] acting within the scope of their actual or apparent authority" commits certain economic offences, including bribery, fraud, and tax evasion.
The Crime and Policing Act 2026 (CPA), in its section 250, extends this trigger to any offence. The business activities affected are very broad and include data protection, environmental practices, labour practices and supply chains, health and safety, consumer protection, and advertising.
Comparison of corporate liability provisions in the EU Directive and UK legislation
The landscape of corporate criminal liability is also changing in Europe. Among other provisions, the Directive outlines two grounds for corporate liability for corruption: (1) direct liability, when someone in a "leadership position" in the company commits a corruption offence "for the benefit of" the company; and (2) secondary or indirect liability, when a "failure of supervision or control" by those in leadership positions has enabled the offence "by a person under their authority".
There are four key areas where UK legislation and the Directive differ, although this will be clarified through case law and when the Directive is transposed:
- "Senior manager" vs "leadership position": a "senior manager" in the CPA is someone who "plays a significant role" in decision-making about how the company's activities are managed or organised, or in the management/organisation of those activities. The Directive (reflecting the EU anti-money laundering directives) defines "leadership position" as someone who has "power of representation" of the company, the authority to "make decisions on behalf of" or "exercise control within" the company. At first glance, "leadership position" appears to encompass fewer individuals in a company than the threshold of "senior manager", and under UK law there is no need to demonstrate that the conduct benefits the company. In practice, assessing the substance of the individual's actual and ostensible power and authority, beyond their mere title, will be key under both the UK and EU regimes, for both companies and prosecutors.
- "Failure to prevent" vs "failure of supervision": EU law established the basis of "failure of supervision or control" for corporate liability in the 1990s, which inspired the offence of "failure to prevent bribery" in the UK and "failure of supervision" offences in the EU anti-money laundering directives. Although the underlying principle is the same, the scope of "associated persons" in the UK Bribery Act is open to interpretation based on the facts, suggesting a broader scope than that of the Directive. The legal position in the UK also focuses more on the company's compliance system than on the supervisory role of individuals in leadership positions.
- Defences vs "mitigating circumstances": under UK legislation, a company has a complete defence against a charge of "failure to prevent bribery" if it can prove that it had adequate procedures in place at the time (the burden of proof lies with the company). However, there is no comparable defence when a company is charged based on the conduct of a senior manager; in this case, the only defences relate to the principal offence. The Directive takes a different approach, due to the type of criminal offence, by placing "genuine, effective, and properly evaluated internal control, ethics, and compliance programmes" as a possible mitigating factor when sentencing a company, but not as a defence.
- Criminalisation of "trading in influence": the Directive reiterates "trading in influence" as a specific offence (defined as exerting "undue influence" over a public official "in order to obtain an undue advantage", even if that advantage does not materialise), unlike UK legislation. While some elements are covered by the UK bribery offence, the broad definition of "public official" in the EU Directive — which extends to individuals in "state-owned enterprises and private companies providing public services" — means that this potentially creates a new facet of risk in the area of lobbying and public procurement for companies.
What does this mean for companies?
It is becoming increasingly easier to prosecute companies for criminal conduct. In the context of corruption, the Directive also establishes severe penalties with corporate fines of at least 2-5% of global turnover (which would have significantly increased the fine for bribery imposed on Glencore Energy Limited) or between 24 and 40 million euros, depending on the offence, in addition to prison sentences for individual offenders.
Managing exposure to risk arising from attribution by "leadership position" and "senior manager" involves updating risk assessments, mapping who is responsible for what, who approves company decisions, who authorises risks, and who appears to manage, organise or supervise, even when the formal title suggests otherwise.
Beyond this, the fundamental pillars of an anti-bribery and anti-corruption framework are applicable to the management of any regulatory risk. These include establishing clear policies, periodic risk assessments, implementing proportionate controls, training (including that given to high-risk business partners), due diligence on third parties, and fostering an organisational culture that incentivises appropriate behaviours and promotes whistleblowing.
Despite the differences, both UK and EU legislation provide a powerful incentive for companies to evaluate their ethics and compliance framework to ensure that measures are fit for purpose and "not a mere paper exercise" or simple "window dressing". Companies should aspire to maintain the highest standards, and these legislative changes present an opportunity to invest in effective compliance.