Corporate Criminal Liability: Attribution, Failure to Prevent Offences, and Corporate Responsibility

Introduction

Corporations occupy a central position in modern economic and social life. They employ workers, provide essential services, manage substantial financial resources, enter into complex contractual relationships, and exercise influence over markets and public institutions. Their activities can generate significant economic and social benefits, but corporate structures can also facilitate fraud, bribery, money laundering, environmental offences, regulatory breaches, and other forms of criminal conduct.

A fundamental question therefore arises in criminal law: when should a company itself be held criminally responsible for an offence committed by one or more individuals acting within its organisational structure?

The question is more complicated than it might initially appear. A company is a legal person, but it does not possess a human mind or act through a physical body of its own. Its decisions are made and its activities are carried out by directors, senior managers, employees, agents, contractors, and other individuals. The criminal law must determine when their conduct and state of mind can be attributed to the corporate entity itself.

Corporate criminal liability in England and Wales has historically developed through several legal mechanisms. The traditional identification doctrine sought to determine whether the individual who committed the offence represented the company’s directing mind and will. Statutory provisions subsequently established additional routes to liability, particularly for corporate manslaughter, bribery, and the facilitation of tax evasion. More recent legislation has introduced broader rules concerning the attribution of offences committed by senior managers and specific offences based on an organisation’s failure to prevent criminal conduct.

The modern framework is therefore not based on a single universal rule. Corporate liability may arise because an offence committed by a sufficiently senior manager is attributed to the organisation, because a statute expressly imposes responsibility for an associated person’s conduct, because the organisation itself breaches a statutory duty, or because the conditions for another recognised form of corporate liability are satisfied.

The Economic Crime and Corporate Transparency Act 2023 introduced important reforms concerning economic crime and created the offence of failure to prevent fraud. The Crime and Policing Act 2026 subsequently extended the senior-manager attribution approach to criminal offences more generally through section 250. These developments are central to understanding the law as it stands in October 2026.

This article examines the principles governing corporate criminal responsibility, the distinction between corporate and individual liability, the statutory failure-to-prevent offences, the importance of compliance systems, and the consequences of corporate prosecution.

1. The Nature of Corporate Criminal Liability

1.1 A corporation as a legal person

A company incorporated under the Companies Act 2006 possesses a legal identity distinct from that of its shareholders and directors. It can own property, enter into contracts, employ individuals, incur debts, sue, and be sued. Its separate legal personality is a fundamental principle of company law, traditionally associated with Salomon v A Salomon & Co Ltd [1897] AC 22.

Separate legal personality, however, does not mean that a company is immune from criminal responsibility. The law can recognise a corporation as the defendant in criminal proceedings and impose penalties appropriate to a legal entity.

Corporate criminal liability must be distinguished from the liability of the individuals who operate the company. A director may be personally guilty of fraud, bribery, or another offence. The company may also be criminally liable if the relevant statutory or common-law requirements are satisfied. Conversely, an employee’s criminal conduct does not automatically establish that the company itself has committed the same offence.

The distinction reflects the fact that corporate and individual responsibility answer different questions. The individual is assessed according to their own conduct, state of mind, participation, and applicable defences. The company’s responsibility depends on the legal rules through which conduct, fault, or a failure to prevent offending is attributed to the organisation.

A company can therefore be prosecuted alongside its directors or employees. A prosecution of the company does not require the prosecution to abandon proceedings against the individuals involved, and an individual conviction does not necessarily establish corporate guilt without the relevant legal basis.

1.2 Why corporate criminal liability is necessary

Without corporate criminal liability, the criminal law could struggle to respond adequately to wrongdoing committed through complex organisations. A company might obtain substantial financial benefits from unlawful conduct while the individuals directly responsible leave the organisation, conceal their involvement, or distribute decisions across several departments.

Consider a company that obtains contracts through systematic bribery. The payments may be arranged by commercial employees, approved through management procedures, processed by an intermediary, and recorded inaccurately by the finance department. If the organisation benefits from the scheme, limiting accountability to the individuals who physically transferred the money may fail to address the corporate dimension of the wrongdoing.

Corporate criminal liability serves several functions. It can impose accountability on the legal entity that benefited from or facilitated the offending. It can deter organisations from allowing unlawful practices to become embedded in their operations. It can encourage effective internal controls, reporting systems, and oversight. It can also support confiscation and other measures intended to prevent criminal conduct from becoming a profitable business strategy.

Nevertheless, corporate liability must be established according to law. The fact that an organisation benefited from an offence does not automatically mean that every employee’s conduct can be attributed to it. The prosecution must identify the applicable route to liability and prove its legal requirements.

1.3 Corporate liability and corporate culture

A corporation does not possess a single human consciousness. Its decisions may emerge from formal board resolutions, delegated authority, departmental practices, incentive structures, informal instructions, or a combination of these factors.

The law must therefore address two related but distinct questions. The first is whether the conduct and state of mind of a particular individual can be treated as those of the corporation. The second is whether the corporation has committed an offence through its own failure to establish, maintain, or implement adequate controls where legislation imposes such a responsibility.

These questions explain the importance of attribution rules and failure-to-prevent offences. Attribution connects individual wrongdoing to the legal entity. Failure-to-prevent legislation can impose responsibility even when the prosecution cannot establish that a senior executive personally authorised or knew about the underlying offence.

The distinction is significant for large organisations, where responsibility is distributed across management levels and operational functions. A company may be exposed to criminal liability even where its board has not expressly approved the unlawful conduct, provided the requirements of the applicable statutory offence or attribution rule are satisfied.

2. The Traditional Identification Doctrine

2.1 The directing mind and will

Historically, the principal common-law mechanism for attributing criminal responsibility to a company was the identification doctrine, also known as the identification principle.

Under the traditional approach, the acts and mental state of an individual could be treated as those of the company where that individual represented its directing mind and will in relation to the relevant function or activity. The doctrine sought to identify the individuals whose decisions were sufficiently central to the organisation to be regarded as the company’s own decisions.

The leading authority is Tesco Supermarkets Ltd v Nattrass [1972] AC 153. The case concerned a statutory offence involving the sale of goods at a price higher than the advertised price. The House of Lords considered whether the conduct of the relevant store manager could be attributed to the company for the purposes of the statutory defence.

The decision became a central authority on the identification principle. It emphasised the distinction between individuals who formed the company’s directing mind and those who acted as employees or delegates within its organisational structure.

The traditional doctrine was not simply a rule that every director’s conduct was automatically the company’s conduct. The court had to examine the company’s constitution, management structure, delegation of authority, and the individual’s actual role in relation to the relevant activity.

A person could hold an important job title without necessarily representing the directing mind and will for every purpose. Equally, the analysis was not confined to the formal label attached to an office. The decisive issue was the individual’s legal and organisational position in relation to the function concerned.

2.2 The difficulty of identifying a company’s directing mind

The traditional identification doctrine became increasingly controversial as corporate structures grew more complex.

Modern corporations frequently distribute authority among regional managers, divisional heads, compliance officers, finance departments, subsidiaries, and specialised operational teams. Important decisions may emerge from a combination of separate functions rather than from a single individual who exercises comprehensive control.

The doctrine could make it difficult to attribute criminal conduct to a large corporation where the individual responsible was senior enough to exercise substantial operational authority but did not qualify as the company’s directing mind under the applicable test.

This difficulty was particularly significant in cases involving economic crime. A manager might have sufficient authority to arrange a fraudulent transaction, approve an unlawful payment, or conceal misconduct within a substantial business division without possessing authority over the organisation as a whole.

The result could be a gap between the scale of the corporate benefit and the legal capacity to attribute the offence to the company itself.

The Law Commission examined these problems in its project on corporate criminal liability. Its work considered possible reforms to make corporate prosecutions more effective and to reflect the structure of modern organisations. The Commission’s analysis is available through its corporate criminal liability project.

2.3 The identification doctrine after statutory reform

The traditional doctrine remains relevant, but it no longer operates as the only mechanism for establishing corporate criminal liability.

The Economic Crime and Corporate Transparency Act 2023 introduced a statutory route for attributing specified economic crimes committed by senior managers. The Crime and Policing Act 2026 then extended the senior-manager approach to criminal offences more generally through section 250.

Consequently, the identification doctrine must now be understood alongside the newer statutory framework. It remains relevant where the common law continues to govern attribution, including cases outside the scope of a specific statutory route or where the statutory requirements are not met.

The modern position is therefore one of overlapping mechanisms rather than the complete disappearance of the traditional principle. The applicable rule must be identified by examining the offence, the date of the alleged conduct, the relevant legislation, and any applicable commencement or transitional provisions.

3. Statutory Attribution Through Senior Managers

3.1 The reform introduced by the Economic Crime and Corporate Transparency Act 2023

The Economic Crime and Corporate Transparency Act 2023 introduced an important reform to corporate criminal attribution for specified economic crimes.

Under the original framework established by section 196 and related provisions of the 2023 Act, a body corporate or partnership could be held criminally liable where a senior manager committed a relevant economic crime while acting within the actual or apparent scope of their authority.

The reform was intended to address the limitations of the traditional directing-mind test. It recognised that a person who exercises substantial managerial authority over a significant part of an organisation may commit an offence within the scope of their responsibilities even if they do not represent the directing mind and will of the company as a whole.

The relevant provisions were designed to make corporate prosecution more effective in cases involving fraud, bribery, money laundering, and other specified economic crimes.

The statutory framework and its background are explained in the official Economic Crime and Corporate Transparency Act 2023 and the government’s guidance on the identification principle for economic crime offences.

3.2 The extension under the Crime and Policing Act 2026

The Crime and Policing Act 2026 represents a further development in corporate criminal attribution.

Section 250 extends the senior-manager attribution approach to criminal offences generally, rather than limiting the new statutory route to the specified economic crimes covered by the 2023 reforms. The provision was brought into force on 29 June 2026.

Under the new approach, a corporate body may be held criminally liable where a senior manager commits an offence while acting within the actual or apparent scope of their authority. The legislation adopts a definition of senior manager focused on the person’s responsibilities and influence within the organisation.

This reform is important because it broadens the circumstances in which the criminal conduct of a senior manager may be attributed to a corporation. The prosecution is no longer necessarily required to establish that the individual was the company’s directing mind and will under the traditional common-law doctrine.

The official government explanation appears in Circular 004/2026: Crime and Policing Act 2026, particularly its discussion of section 250.

The reform does not mean that every offence committed by a manager automatically becomes an offence of the company. The prosecution must establish the relevant offence, show that the individual meets the statutory definition of senior manager, and demonstrate that the individual acted within the actual or apparent scope of their authority.

The precise statutory provisions, their application to the offence concerned, and any relevant transitional rules must be examined in each case.

3.3 Who qualifies as a senior manager?

The statutory definition focuses on the substance of the individual’s responsibilities rather than merely their job title.

A senior manager is an individual who plays a significant role in decisions about how the whole or a substantial part of the organisation’s activities are managed or organised, or who plays a significant role in the actual management or organisation of those activities.

This approach is intended to reflect the reality of corporate governance. In a large company, a person responsible for a substantial business division may exercise considerable influence over the organisation’s activities even if they are not a board member or chief executive.

For example, a regional executive responsible for a major commercial operation might control significant budgets, determine operational policy, supervise managers, and approve transactions within a substantial part of the business. Depending on the facts, that person’s responsibilities may satisfy the statutory definition.

By contrast, a junior employee who carries out routine instructions will not ordinarily qualify as a senior manager merely because the employee performs an important task or commits an offence that benefits the company.

The assessment is functional rather than purely formal. Job descriptions, reporting lines, delegation documents, decision-making records, internal policies, and the practical exercise of authority may all be relevant.

3.4 Actual and apparent authority

The requirement that the senior manager act within the actual or apparent scope of their authority is another important limitation.

Actual authority concerns the authority the organisation has genuinely conferred on the individual. It may arise from formal delegation, contractual arrangements, board decisions, established management responsibilities, or other organisational arrangements.

Apparent authority concerns the authority the individual appears to possess from the relevant perspective, based on the organisation’s representations or conduct and the applicable legal principles.

The statutory requirement prevents the attribution rule from becoming an automatic mechanism for treating every private act of a senior manager as corporate conduct. The connection between the offence and the individual’s managerial authority must be established.

Suppose a senior commercial manager uses their delegated authority to arrange a fraudulent transaction in the course of managing a major business unit. The statutory attribution rule may apply if the offence and the manager’s authority satisfy the legal requirements.

If the same individual commits an unrelated offence in a purely private capacity, the fact that they hold a senior position does not, without more, establish corporate criminal liability.

The central question is whether the offence was committed within the relevant scope of authority, not simply whether the offender happened to be employed by the company.

4. Failure-to-Prevent Offences: A Different Model of Corporate Responsibility

4.1 From attribution to prevention

Failure-to-prevent offences represent a different approach to corporate criminal liability.

Under ordinary attribution rules, the prosecution generally seeks to establish a legal connection between the offence and the corporation through the conduct or state of mind of an individual. Failure-to-prevent legislation instead imposes liability where a person associated with the organisation commits a specified underlying offence in circumstances defined by statute and the organisation cannot establish the applicable prevention-procedures defence.

This model does not ordinarily require the prosecution to prove that the board authorised the underlying offence or that a particular senior executive knew it was taking place.

The focus is on the organisation’s responsibility to establish and maintain appropriate procedures to prevent specified criminal conduct by persons performing services for or on its behalf.

This approach reflects the practical reality that corporate wrongdoing may occur without an explicit instruction from senior management. A company may benefit from misconduct carried out by an intermediary, employee, agent, or other associated person even where its senior executives claim not to have known about it.

Failure-to-prevent offences seek to encourage organisations to address those risks before criminal conduct occurs.

They do not, however, create an unlimited duty to prevent every conceivable offence. Each offence has its own statutory scope, requirements, and defences.

4.2 The principal failure-to-prevent offences

The principal failure-to-prevent offences relevant to corporate criminal liability in England and Wales include:

• Failure to prevent bribery under section 7 of the Bribery Act 2010.
• Failure to prevent the criminal facilitation of UK tax evasion under section 45 of the Criminal Finances Act 2017.
• Failure to prevent the criminal facilitation of foreign tax evasion under section 46 of the Criminal Finances Act 2017.
• Failure to prevent fraud under section 199 of the Economic Crime and Corporate Transparency Act 2023.

These offences differ in their precise statutory requirements, the organisations to which they apply, the conduct that triggers liability, and the prevention-procedures defence available.

The offences should not be treated as identical merely because they share the phrase “failure to prevent”. A proper analysis requires examination of the relevant legislation and any applicable government guidance.

4.3 Failure to prevent bribery

Section 7 of the Bribery Act 2010 creates an offence where a relevant commercial organisation fails to prevent bribery by a person associated with it.

The underlying bribery must fall within the statutory framework, including the requirement that the associated person bribes another person with the intention of obtaining or retaining business for the organisation or obtaining or retaining a business advantage for it.

The offence is significant because the organisation may be liable even if its senior management did not authorise or know about the bribe.

The statutory defence is that the organisation had adequate procedures designed to prevent persons associated with it from engaging in bribery. The assessment is contextual: the existence of a written anti-bribery policy does not necessarily establish that the organisation had adequate procedures in practice.

The relevant framework is set out in section 7 of the Bribery Act 2010. The government’s guidance on procedures that commercial organisations can implement to prevent bribery is also important when assessing the defence.

The legislation encourages organisations to examine their exposure to bribery risks, the conduct of intermediaries, the use of commissions and other payments, and the effectiveness of internal controls.

4.4 Failure to prevent the criminal facilitation of tax evasion

Sections 45 and 46 of the Criminal Finances Act 2017 introduced corporate offences concerning the failure to prevent the criminal facilitation of tax evasion.

Section 45 concerns the failure to prevent the facilitation of UK tax evasion, while section 46 addresses the facilitation of foreign tax evasion within the relevant statutory framework.

The offences distinguish between tax evasion itself and the criminal facilitation of tax evasion by a person associated with an organisation. The corporate offence is concerned with the organisation’s failure to prevent associated persons from facilitating the underlying criminal conduct.

For example, a financial services business might provide services through an intermediary who deliberately assists a client in concealing taxable income through criminal means. Whether the organisation commits the relevant corporate offence depends on the statutory requirements, including the underlying tax evasion, the associated person’s criminal facilitation, and the relationship between that conduct and the organisation.

The organisation may have a defence if it can establish that it had reasonable prevention procedures in place or that it was not reasonable in all the circumstances to expect it to have such procedures.

The official government guidance on corporate offences for failing to prevent criminal facilitation of tax evasion explains the framework and identifies six guiding principles: risk assessment, proportionality of procedures, top-level commitment, due diligence, communication and training, and monitoring and review.

4.5 Failure to prevent fraud

Section 199 of the Economic Crime and Corporate Transparency Act 2023 introduced a further failure-to-prevent offence, which came into force on 1 September 2025.

The offence applies to qualifying large organisations and concerns specified fraud offences committed by associated persons in circumstances where the statutory benefit requirement is satisfied.

Broadly, a relevant organisation may be liable where an associated person commits a specified fraud offence intending to benefit the organisation or, in qualifying circumstances, a person to whom the organisation provides services. The organisation may have a defence if it had reasonable fraud prevention procedures in place, or if it was reasonable in all the circumstances not to have such procedures.

The legislation is designed to address circumstances in which organisations benefit from fraud committed through their operations without requiring proof that the board or senior executives authorised or knew about the offending.

The offence is not confined to traditional fraudulent representations made directly by a director. It may cover specified forms of fraud committed by employees, agents, subsidiaries, or other associated persons, subject to the statutory conditions.

The relevant provision is section 199 of the Economic Crime and Corporate Transparency Act 2023. The government has also published guidance on the offence of failure to prevent fraud, updated in October 2025.

4.6 Which organisations are covered?

The failure-to-prevent fraud offence does not apply indiscriminately to every business.

The legislation defines qualifying large organisations by reference to statutory size criteria. These criteria concern employee numbers, turnover, and balance-sheet totals, and the applicable test must be examined in accordance with the legislation and relevant accounting rules.

The statutory framework also contains provisions concerning parent undertakings and the circumstances in which fraud committed by an associated person of a subsidiary may create liability for the parent organisation.

This is important because corporate groups often distribute operations, management responsibilities, and financial transactions among multiple legal entities. The fact that two companies belong to the same group does not automatically mean that they are interchangeable for criminal liability purposes.

The correct legal entity must be identified, and the statutory conditions must be established in relation to that entity.

5. Associated Persons and the Scope of Corporate Responsibility

5.1 Who is an associated person?

Failure-to-prevent legislation commonly uses the concept of an associated person to identify individuals or entities whose conduct may trigger corporate liability.

The precise statutory definition depends on the offence, but the underlying question is generally whether the person performs services for or on behalf of the relevant organisation.

Employees, agents, intermediaries, contractors, and consultants may fall within the relevant definition, depending on the nature of their relationship and the statutory wording. Formal contractual labels are not necessarily decisive.

A company cannot always avoid responsibility simply by outsourcing a function or engaging an intermediary rather than employing the person directly. The relevant legislation is concerned with the substance of the relationship and the capacity in which the person performs services.

Nevertheless, not every independent business partner is automatically an associated person. The statutory requirements must be examined in the particular context.

5.2 Corporate groups and subsidiaries

Corporate groups create particular difficulties because each incorporated company ordinarily has its own legal personality.

A parent company may exercise strategic control over a subsidiary while the subsidiary employs its own staff, enters into its own contracts, and conducts its own operations. Criminal liability must therefore be assessed by reference to the relevant legal entity and the applicable statutory rules.

Under the failure-to-prevent fraud regime, specific provisions may extend liability to a parent undertaking in qualifying circumstances. The parent cannot simply be treated as criminally responsible for every offence committed by every subsidiary. The statutory conditions governing the underlying offence, the associated person, and the relevant benefit must be satisfied.

Similarly, a subsidiary’s criminal liability does not automatically establish that its parent committed the same offence. Separate corporate personality remains important, subject to the rules that specifically govern attribution, participation, and statutory responsibility.

5.3 Outsourcing does not necessarily eliminate risk

Organisations frequently rely on third-party service providers for sales, procurement, logistics, customer verification, accounting, marketing, and other business functions.

Outsourcing may change the legal and operational structure of a transaction, but it does not automatically remove corporate criminal exposure. Where an intermediary performs services for or on behalf of the organisation, the relevant failure-to-prevent legislation may apply if the other statutory conditions are satisfied.

A company should therefore assess not only its direct employees but also the third parties through whom it conducts business. The extent of due diligence and oversight required will depend on the organisation’s activities, the nature of the services, the geographical context, and the risks identified.

This is one reason why effective compliance systems must extend beyond formal employment relationships. An organisation that carefully supervises its employees but ignores the conduct of high-risk intermediaries may leave a significant gap in its prevention procedures.

6. Corporate Manslaughter and Organisational Failure

Corporate criminal responsibility is not confined to financial and economic crime. The Corporate Manslaughter and Corporate Homicide Act 2007 establishes a distinct offence concerning fatal failures in the way an organisation’s activities are managed or organised.

Under section 1 of the Act, an organisation may be guilty of corporate manslaughter where the way in which its activities are managed or organised causes a person’s death and amounts to a gross breach of a relevant duty of care owed by the organisation to the deceased.

The offence requires the jury to consider the extent to which the organisation’s conduct fell below what could reasonably have been expected in the circumstances. The role of senior management in the organisation’s breach is a substantial element of the statutory test.

The legislation was intended to address the limitations of the traditional identification doctrine in cases where a fatal failure resulted from the way an organisation operated rather than from the isolated conduct of a single controlling individual.

For example, a company operating industrial machinery might repeatedly disregard serious safety risks, fail to maintain essential equipment, and ignore warnings about dangerous working conditions. If the relevant statutory elements are established and the failure causes a death, the organisation may face prosecution for corporate manslaughter.

The offence is not established merely because an employee dies at work or because an accident occurs. The prosecution must prove the statutory elements, including causation, breach of the relevant duty of care, and the required grossness of the breach.

The Act also contains provisions concerning the organisations to which the offence applies and the treatment of certain public functions. The details matter because the offence is defined by statute rather than by a general principle that every fatal accident creates corporate criminal liability.

The legislation is available through the Corporate Manslaughter and Corporate Homicide Act 2007.

Corporate manslaughter illustrates an important distinction between individual misconduct and organisational failure. A death may result from a combination of deficient safety systems, inadequate training, poor supervision, and management decisions. The law can assess the organisation’s management and organisation of its activities rather than focusing exclusively on the person who immediately caused the fatal event.

7. Corporate Liability and Individual Responsibility

7.1 Can a company and its directors both be prosecuted?

Yes. Corporate criminal liability does not generally displace the personal responsibility of directors, managers, or employees.

Where the evidence supports it, a company and the individuals involved may be prosecuted in relation to the same underlying conduct. The company may be liable under a statutory attribution rule, a failure-to-prevent offence, or another applicable provision. An individual may be liable as the principal offender, an accomplice, or under a separate statutory offence.

The legal requirements must be assessed separately for each defendant. The prosecution must establish the company’s liability through the relevant corporate route and prove the elements of the individual’s offence.

A director is not automatically criminally liable merely because they hold office when an offence occurs. Personal liability depends on the relevant offence and the director’s own conduct, state of mind, participation, or other legally sufficient basis of responsibility.

Conversely, a director cannot necessarily avoid personal liability by arguing that the company was the principal beneficiary. Where the director personally commits, encourages, assists, or participates in an offence, the ordinary rules governing individual criminal liability may apply.

7.2 Consent, connivance, and neglect

Certain statutory provisions impose personal liability on directors or officers where an offence committed by a corporate body occurs with their consent or connivance, or is attributable to their neglect.

The exact conditions vary according to the statute. It is therefore necessary to examine the provision governing the offence rather than assume that the same rule applies throughout criminal law.

Consent generally concerns a person’s agreement to the offending conduct. Connivance involves a form of knowing acquiescence or involvement, depending on the statutory context. Neglect concerns a failure to exercise the responsibility required by the relevant legal provision.

These concepts must not be treated as interchangeable with the mere fact that an individual occupies a senior position. The prosecution must establish the relevant statutory conditions.

For example, if legislation expressly provides that an officer is personally liable where a corporate offence is committed with their consent or connivance, the prosecution must prove the required connection between that officer and the offence. The provision does not necessarily make every director liable for every corporate breach.

7.3 The limits of the corporate veil

The principle of separate corporate personality means that a company and its shareholders are generally distinct legal persons. It does not, however, create immunity from criminal law.

The criminal law can impose liability on the company itself, on individuals who commit offences through it, or on both where the applicable legal requirements are met.

The corporate veil should therefore not be understood as a device through which unlawful conduct becomes legally invisible. Equally, it should not be treated as a concept that can be disregarded whenever a company commits wrongdoing.

The legal analysis depends on the applicable attribution rules, statutory provisions, and evidence. The separate personality of the company remains the starting point, while specific legal rules determine when responsibility can be attributed to the company or its officers.

8. Compliance Systems and the Prevention-Procedures Defence

8.1 The importance of prevention procedures

The failure-to-prevent offences create a direct incentive for organisations to develop effective systems designed to prevent specified criminal conduct.

Under the Bribery Act 2010, the relevant defence concerns adequate procedures. Under the Criminal Finances Act 2017 and the failure-to-prevent fraud provisions, the legislation refers to reasonable prevention procedures, subject to the precise statutory language.

The terminology differs, but the underlying question is whether the organisation took appropriate measures to address the relevant risks in the circumstances.

A compliance system should not be assessed solely by reference to the number of policies a company has written. The court may need to consider whether the procedures were suitable for the organisation’s activities, communicated effectively, implemented in practice, and monitored over time.

A policy that exists only on paper may provide little protection if employees receive no training, managers ignore warnings, or the organisation rewards conduct that creates a substantial risk of offending.

8.2 Risk assessment

An effective prevention programme begins with an assessment of the risks relevant to the organisation.

A business operating in several jurisdictions, using agents to secure contracts, and conducting transactions with public bodies may face different bribery risks from a small domestic business with limited external dealings.

Similarly, a company with complex sales incentives, extensive customer relationships, and decentralised financial reporting may face particular fraud risks.

Risk assessment should identify where criminal conduct could occur, who might facilitate it, what incentives or weaknesses might encourage it, and which controls are required to reduce the risk.

The assessment should be proportionate to the organisation’s activities and updated when its business model, geographical exposure, or operational structure changes.

8.3 Proportionate procedures and due diligence

Prevention procedures should be proportionate to the risks identified.

An organisation may need enhanced due diligence for high-risk intermediaries, additional approval requirements for unusual payments, segregation of financial responsibilities, or more intensive monitoring of certain transactions.

Due diligence is particularly important where third parties act on behalf of the organisation. The company should understand the intermediary’s role, the legitimacy of the proposed services, the basis of remuneration, and any warning signs that may indicate a risk of bribery, fraud, or tax evasion.

The relevant controls will vary by offence and organisation. There is no universal checklist that automatically establishes a defence in every case.

8.4 Top-level commitment and organisational culture

Senior management commitment is important because prevention procedures depend on the behaviour and expectations of the organisation’s leadership.

If executives publicly endorse compliance but privately encourage employees to ignore legal restrictions in pursuit of revenue, the organisation’s formal policies may be undermined by its actual practices.

An effective compliance culture should make clear that unlawful conduct is not an acceptable method of achieving business objectives. Employees should understand the applicable rules, know how to raise concerns, and have confidence that legitimate reports will be taken seriously.

Leadership commitment must be reflected in decisions, resource allocation, incentives, supervision, and the response to suspected misconduct.

8.5 Communication, training, monitoring, and review

Prevention procedures must be communicated to the individuals expected to follow them.

Training should be appropriate to the person’s role and the risks they face. Employees responsible for sales, procurement, financial reporting, or dealings with intermediaries may require different forms of guidance from those working in other areas.

Monitoring and review are equally important. A compliance programme that was appropriate several years ago may become inadequate as the organisation expands, enters new markets, changes its technology, or adopts new business practices.

Organisations should therefore review their procedures periodically, investigate warning signs, and respond to identified weaknesses. The aim is not merely to demonstrate the existence of a compliance framework but to ensure that the framework operates effectively.

8.6 What does not automatically establish a defence?

Several assumptions can create a misleading impression of legal protection.

A written policy does not automatically prove that prevention procedures were adequate or reasonable. The appointment of a compliance officer does not necessarily establish that the organisation exercised sufficient oversight. An employee’s violation of internal rules does not, by itself, prove that the company had effective procedures in place.

Equally, the existence of an offence does not automatically establish that the organisation’s prevention procedures were inadequate. The statutory defence must be assessed according to its own requirements and the evidence.

The law therefore encourages a substantive examination of the organisation’s controls rather than a purely formal assessment of its documentation.

9. Investigation and Prosecution of Corporate Offences

9.1 Identifying the correct corporate defendant

Corporate prosecutions require careful identification of the legal entity alleged to have committed the offence.

A corporate group may include a parent company, several subsidiaries, operating companies, and special-purpose entities. Their names may be similar, and their business activities may overlap, but they remain distinct legal persons unless the law provides otherwise.

The prosecution must identify the entity against which the relevant legal requirements can be established. This is particularly important where contracts, payments, employees, and benefits are distributed among different companies within the same group.

The fact that one entity benefited from an offence does not automatically establish that another group company committed it. The applicable attribution rules and statutory requirements must be satisfied for each defendant.

9.2 Evidence in corporate investigations

Corporate investigations may involve substantial documentary and digital evidence.

Relevant material can include board minutes, internal emails, financial records, contracts, payment instructions, compliance reports, audit findings, employee communications, delegation documents, and records of decisions made by senior managers.

The prosecution may need to establish who made a decision, what authority that person possessed, whether the conduct fell within the scope of their role, and whether the statutory or common-law requirements for corporate liability are satisfied.

In failure-to-prevent cases, the investigation may also examine the organisation’s risk assessments, training materials, due-diligence procedures, internal reporting mechanisms, and responses to warning signs.

The existence of a corporate compliance programme may be relevant to the statutory defence, but the investigation must distinguish between the formal existence of procedures and their practical operation.

9.3 The role of the Crown Prosecution Service and the Serious Fraud Office

Corporate prosecutions may involve the Crown Prosecution Service, the Serious Fraud Office, or other enforcement authorities, depending on the nature of the offence and the relevant statutory framework.

The Crown Prosecution Service has published guidance on the principles governing corporate prosecutions, the available routes to corporate criminal liability, evidential considerations, charging decisions, and sentencing.

Its guidance is available through Corporate Prosecutions.

The prosecution decision must comply with the applicable legal and procedural requirements. The existence of a suspected corporate offence does not mean that prosecution is automatic. The evidence, applicable legal tests, public-interest considerations, and any relevant statutory requirements must be examined.

The precise role of each authority depends on the offence, the relevant investigative powers, and the statutory arrangements governing the case.

10. Corporate Penalties and Consequences of Conviction

10.1 Fines

A principal consequence of corporate criminal conviction is the imposition of a financial penalty.

The maximum penalty depends on the offence and the applicable legislation. Some corporate offences carry unlimited fines, while others have specific statutory limits.

A fine may be intended to punish the organisation, deter future offending, and reflect the seriousness of the conduct. In determining the appropriate penalty, the court may consider the nature of the offence, the organisation’s culpability, the harm caused, the financial benefit obtained, and the relevant sentencing guidelines.

A corporate fine is distinct from a confiscation order. A fine punishes the offence, whereas confiscation under the Proceeds of Crime Act 2002 is concerned with depriving offenders of the benefit obtained from criminal conduct, subject to the applicable statutory framework.

The financial consequences of a corporate conviction can therefore extend beyond the fine itself.

10.2 Confiscation and recovery of criminal benefit

Where the statutory requirements are satisfied, confiscation proceedings may seek to recover the benefit obtained from criminal conduct.

The Proceeds of Crime Act 2002 provides the principal framework for confiscation in England and Wales, including provisions governing the assessment of benefit and the amount recoverable.

The distinction between a fine and confiscation is important. A company should not assume that paying a criminal fine necessarily eliminates the possibility of a separate order designed to recover criminal benefit.

The relevant powers depend on the offence, the proceedings, and the applicable statutory provisions. The court must apply the legal framework governing the particular case.

10.3 Deferred prosecution agreements

In qualifying cases, a corporate prosecution may be resolved through a deferred prosecution agreement, commonly known as a DPA.

A DPA is an agreement between a prosecutor and an organisation under which prosecution is suspended on agreed terms, subject to judicial approval and statutory requirements. If the organisation complies with the agreement, the prosecution may be discontinued in accordance with the relevant legal framework. If the organisation fails to comply, the prosecution may be resumed.

DPAs are governed by Schedule 17 to the Crime and Courts Act 2013. They are available only for qualifying offences and organisations, and they are subject to judicial scrutiny.

The court must consider the statutory requirements, including whether the agreement is in the interests of justice and whether its terms are fair, reasonable, and proportionate.

A DPA is not an automatic entitlement for an organisation that reports wrongdoing. The circumstances of the case, the conduct of the organisation, the applicable legal requirements, and the public interest remain important.

10.4 Reputational and operational consequences

Corporate criminal proceedings may have consequences beyond formal penalties.

An investigation or conviction may affect relationships with customers, investors, lenders, regulators, public authorities, and business partners. It may also lead to increased compliance costs, restrictions on certain activities, changes in management, or difficulties securing future contracts.

The extent of these consequences depends on the nature of the offence, the sector in which the organisation operates, and the legal and commercial context.

These consequences do not replace the formal legal requirements governing liability and punishment. They nevertheless explain why corporate criminal compliance is a matter of organisational governance rather than merely a technical legal function.

11. Corporate Criminal Liability in the Modern Legal System

The development of corporate criminal liability reflects a broader transformation in the way the law understands organisational wrongdoing.

Traditional legal approaches often sought to identify a particular individual whose mind and conduct could be treated as those of the company. That approach remains relevant, but it has proved insufficient to address every situation in which criminal conduct emerges from complex corporate structures.

The senior-manager attribution rules and failure-to-prevent offences respond to different aspects of this problem.

Senior-manager attribution recognises that substantial managerial responsibility may exist below the highest level of corporate leadership. Where the statutory requirements are satisfied, the organisation may be held responsible for an offence committed by a senior manager acting within the scope of their authority.

Failure-to-prevent offences address a different question. They recognise that certain organisations have responsibilities to establish reasonable or adequate procedures designed to prevent specified criminal conduct by associated persons. Liability may arise without proof that senior management authorised or knew about the underlying offence, subject to the relevant statutory requirements and defence.

Corporate manslaughter illustrates another approach, focusing on the way an organisation’s activities are managed or organised and the role of senior management in a gross breach of a relevant duty of care that causes death.

These mechanisms should not be collapsed into a single general principle. Each has its own legal foundation, scope, and requirements. Nevertheless, together they reflect the growing importance of organisational responsibility in criminal law.

The modern corporation is not merely a passive setting in which individuals commit offences. Its systems, incentives, allocation of authority, supervision, and internal culture can influence how conduct occurs and whether wrongdoing is prevented or facilitated.

The law must therefore address both individual culpability and the circumstances in which an organisation itself should be treated as criminally responsible.

Key Takeaways

Corporate criminal liability allows a company to be prosecuted and punished as a legal entity. Its liability is distinct from the personal criminal responsibility of directors, managers, and employees.

The traditional identification doctrine attributes conduct and mental state to a company where the individual represents its directing mind and will under the relevant common-law principles. The doctrine remains relevant but must now be considered alongside statutory attribution rules.

Section 250 of the Crime and Policing Act 2026 extends the senior-manager attribution approach to criminal offences generally. The relevant statutory test focuses on the individual’s managerial responsibilities and whether the offence was committed within the actual or apparent scope of their authority.

Failure-to-prevent offences establish a different route to corporate liability. The principal examples concern bribery under the Bribery Act 2010, criminal facilitation of tax evasion under the Criminal Finances Act 2017, and fraud under section 199 of the Economic Crime and Corporate Transparency Act 2023.

The failure-to-prevent fraud offence applies to qualifying large organisations and came into force on 1 September 2025. The organisation may have a defence where it had reasonable fraud prevention procedures in place or where it was reasonable in all the circumstances not to have such procedures.

Corporate manslaughter is governed by the Corporate Manslaughter and Corporate Homicide Act 2007 and concerns fatal failures in the management or organisation of activities that satisfy the statutory requirements.

Corporate and individual defendants may be prosecuted in relation to the same conduct, but liability must be established separately for each according to the applicable legal rules.

Effective compliance systems, including risk assessment, due diligence, training, internal reporting, monitoring, and review, are central to the prevention-procedures defences under the relevant legislation.

Corporate penalties may include fines, confiscation orders, and other consequences. Deferred prosecution agreements are available only in qualifying circumstances and are subject to judicial approval.

Frequently Asked Questions

1. Can a company be criminally liable in England and Wales?

Yes. A company may be prosecuted where the requirements of an applicable statutory offence, attribution rule, or recognised form of corporate criminal liability are satisfied. The legal basis may involve the conduct of a senior manager, a failure-to-prevent offence, corporate manslaughter, or another statutory provision.

2. What is the identification doctrine?

The identification doctrine is the traditional common-law approach under which the acts and state of mind of an individual representing the company’s directing mind and will may be attributed to the corporation. Its development is closely associated with Tesco Supermarkets Ltd v Nattrass [1972] AC 153. The doctrine remains relevant but operates alongside more recent statutory attribution mechanisms.

3. What changed under the Crime and Policing Act 2026?

Section 250 extends the senior-manager attribution approach to criminal offences generally. It permits corporate liability where a senior manager commits an offence within the actual or apparent scope of their authority, subject to the statutory requirements. The provision came into force on 29 June 2026.

4. What is a failure-to-prevent offence?

A failure-to-prevent offence imposes criminal liability on an organisation where a person associated with it commits specified underlying criminal conduct in circumstances defined by statute, unless the organisation establishes the applicable prevention-procedures defence. These offences can apply without proof that the board or senior management authorised or knew about the underlying conduct.

5. Which laws create failure-to-prevent offences?

The principal examples are section 7 of the Bribery Act 2010, sections 45 and 46 of the Criminal Finances Act 2017, and section 199 of the Economic Crime and Corporate Transparency Act 2023. Each offence has its own statutory requirements and defence.

6. Does the failure-to-prevent fraud offence apply to every company?

No. Section 199 of the Economic Crime and Corporate Transparency Act 2023 applies to qualifying large organisations as defined by the legislation. The offence also requires the relevant underlying fraud, an associated person, and the statutory benefit conditions to be established.

7. Can a director be personally prosecuted as well as the company?

Yes. A company and an individual may both be prosecuted in relation to the same conduct where the legal requirements for each defendant are satisfied. A director’s personal liability depends on the relevant offence and their own conduct, participation, state of mind, or other legally sufficient basis of responsibility.

8. What are reasonable or adequate prevention procedures?

These are procedures designed to prevent the relevant forms of criminal conduct. Depending on the offence, they may include risk assessments, due diligence, proportionate controls, training, internal reporting mechanisms, monitoring, and periodic review. Their legal adequacy or reasonableness depends on the statutory test and the circumstances of the organisation.

9. What is corporate manslaughter?

Corporate manslaughter is an offence under the Corporate Manslaughter and Corporate Homicide Act 2007. It concerns a death caused by the way an organisation’s activities are managed or organised, where the conduct amounts to a gross breach of a relevant duty of care and the other statutory requirements are satisfied.

10. What penalties can a company face following a criminal conviction?

Depending on the offence and the statutory framework, penalties may include a fine, confiscation of criminal benefit, and other legally authorised orders. A qualifying organisation may also be able to enter into a deferred prosecution agreement, subject to the applicable conditions and judicial approval.

Conclusion

Corporate criminal liability is an essential component of the modern law of England and Wales. It ensures that criminal accountability can extend beyond the individuals who directly perform unlawful acts to the legal entities whose activities, authority structures, and failures may satisfy the requirements for corporate responsibility.

The traditional identification doctrine established an important foundation by recognising that the conduct and state of mind of certain senior individuals could be attributed to a company. However, the complexity of modern organisations exposed the limitations of relying exclusively on the directing-mind test.

The statutory reforms introduced through the Economic Crime and Corporate Transparency Act 2023 and the Crime and Policing Act 2026 have broadened the framework for attributing criminal conduct to corporations. At the same time, failure-to-prevent offences have established a distinct form of responsibility that places greater emphasis on the organisation’s systems for preventing specified criminal conduct.

These developments do not mean that companies are automatically liable for every offence committed by an employee or business partner. Corporate criminal responsibility remains governed by defined legal tests, statutory conditions, and evidential requirements. The distinction between the company’s liability and that of its officers remains fundamental.

The broader principle is that corporate responsibility must reflect both the legal structure of the organisation and the realities of its operations. A company cannot necessarily escape accountability merely because wrongdoing was distributed among different employees or concealed from its board. Equally, the law must not attribute every individual offence to an organisation without satisfying the relevant legal requirements.

The modern framework therefore seeks to balance accountability with legal certainty. By combining attribution rules, failure-to-prevent offences, organisational duties, and established principles of individual criminal responsibility, the law attempts to ensure that corporate structures do not become instruments through which criminal conduct can be committed without effective accountability.

Related Analysis in Criminal Law

Criminal Law

Criminal Law

The 10 Most Stolen Cars in the U.S. in the Past 5 Years: The Big Picture

Read Module →

Criminal Law

Criminal Law

The 10 Most Dangerous Cybercrimes

Read Module →

Criminal Law

Criminal Law

Modern Criminal Offences: Online Harassment, Cybercrime, and Digital Misconduct

Read Module →