Corporate Governance / Regulatory Compliance  |  8 min read  |  Raayzel Business Consulting

Section 250 of the Crime and Policing Act 2026: what boards and CFOs must address now

On 29 June 2026, Section 250 of the Crime and Policing Act 2026 came into force. It represents the most significant expansion of UK corporate criminal liability in over a century. Under the new regime, companies and partnerships can be held criminally liable for any criminal offence committed by a senior manager acting within the actual or apparent scope of their authority. Any offence. Not the targeted list of economic crimes that previous legislation addressed. Any offence under UK criminal law.

The significance of this change is not yet fully reflected in the governance conversations happening at board and CFO level. Most organisations that have addressed it at all have treated it as a legal advisory matter to be managed by General Counsel. That framing underestimates the governance design challenge that Section 250 creates. This is not a legal risk to be insured against. It is a governance architecture problem that requires boards and senior leadership teams to understand their criminal exposure in a fundamentally different way from anything that has applied before.

The legal profession has written extensively about the mechanics of Section 250 since Royal Assent on 29 April 2026. What has not been adequately addressed is the governance design question that follows from those mechanics: given that corporate criminal liability now attaches to the conduct of a potentially wide population of senior managers across the organisation, what does the board need to build, maintain, and demonstrate to provide credible oversight of that exposure? That is the question this article is designed to answer.

The old regime and why it failed

For most of the past century, the dominant principle governing UK corporate criminal liability was the identification doctrine, also described as the directing mind and will test. Under this principle, a company could only be held criminally liable where the person committing the criminal offence was, in effect, the company itself. In practice this meant board directors or, in some interpretations, the most senior executives who could be said to embody the company’s decision-making at its highest level.

The doctrine was criticised extensively, and for good reason. In large, complex organisations with distributed management structures, establishing that the directing mind and will of the company had committed a criminal act was extraordinarily difficult. Prosecutors faced the challenge of proving not just that a crime had been committed but that the individual committing it was sufficiently senior and central to the organisation’s decision-making to satisfy the identification test. As corporate structures became more complex and decision-making became more distributed through the late twentieth and early twenty-first centuries, the doctrine became progressively more difficult to apply in the cases where it mattered most.

High-profile corporate failures where criminal conduct was proven at an operational level but could not be attributed to the organisation because it could not be traced to the directing mind illustrated the inadequacy of the test repeatedly. Regulators and prosecutors called consistently for reform. The Economic Crime and Corporate Transparency Act 2023 was the first significant legislative response, introducing a senior manager attribution model for a defined list of economic crimes. Section 250 of the Crime and Policing Act 2026 completes that reform by extending the senior manager attribution model to the full range of UK criminal offences.

What Section 250 actually does

Section 250 replaces the identification doctrine with a considerably lower threshold for corporate criminal liability. From 29 June 2026, a company or partnership is criminally liable where a senior manager commits a criminal offence while acting within the actual or apparent scope of their authority. The provision applies to UK-incorporated entities and, significantly, to certain non-UK corporations and partnerships where the relevant conduct constitutes an offence under UK law. International businesses with UK operations, UK employees, or UK counterparties cannot treat Section 250 as a domestic UK matter that does not apply to them.

Three elements of the provision require particular attention from a governance perspective.

The first is the breadth of the offence scope. Previous corporate criminal liability regimes identified specific categories of conduct to which the senior manager attribution model applied. Section 250 identifies no such categories. The provision applies to any criminal offence. Health and safety offences, data protection offences, environmental offences, financial services regulatory offences, employment law criminal provisions, harassment, and any other category of criminal conduct that might be committed in the course of a senior manager exercising their authority over a substantial part of the business all fall within scope. The compliance programme that was adequate before Section 250 came into force was calibrated around a much narrower risk universe.

The second is the absence of a prevention procedures defence. The failure to prevent fraud offence introduced by the Economic Crime and Corporate Transparency Act 2023 allowed organisations to defend themselves by demonstrating that they had reasonable procedures in place to prevent the relevant conduct. Section 250 contains no equivalent. There is no defence available to an organisation that can demonstrate it had excellent governance, comprehensive compliance procedures, and rigorous oversight of senior manager conduct. If a senior manager commits an offence within the scope of their authority, the corporate is liable. The governance programme does not provide a legal defence. What it does, as discussed below, is reduce the probability that the liability-creating conduct occurs in the first place and determine how the organisation is perceived by enforcement authorities and courts if it does.

The third is the actual or apparent authority formulation, which creates an exposure that is less intuitive than straightforward actual authority liability but potentially more significant from a governance perspective. Actual authority is conduct the senior manager was genuinely authorised to carry out. Apparent authority is conduct a third party could reasonably conclude the senior manager had authority to carry out, even if they did not have formal authorisation to do so. The distinction matters because apparent authority liability can arise from conduct the board never intended to authorise and may not have been aware of, provided the conduct fell within what a reasonable external party would perceive as the senior manager’s scope.

The senior manager definition: wider than most boards realise

The definition of senior manager under Section 250 is inherited from the Economic Crime and Corporate Transparency Act 2023, where it was applied to the failure to prevent fraud offence and other targeted economic crime provisions. It captures individuals who play a significant role in the decision-making relating to, or the actual managing or organising of, the whole or a substantial part of an organisation’s activities.

The critical phrase is a substantial part of the organisation’s activities. This is not limited to those who make decisions about the organisation as a whole. It extends to those who make decisions about, or manage, a substantial part of it. In a large organisation with multiple business divisions, significant operational functions, or major geographic territories, the population of individuals who play a significant role in the decision-making relating to a substantial part of the business is considerably larger than the board and executive committee.

Consider the practical implications. A divisional chief executive who manages a substantial revenue-generating business unit. A regional managing director responsible for a significant geographic territory. A chief operating officer whose function touches a substantial part of the operational activities. A head of a major compliance or risk function whose decisions affect how the organisation manages exposure across a substantial part of its activities. Each of these individuals may fall within the senior manager definition depending on the specific facts of their role and the organisation’s structure.

Whether any specific individual meets the definition will be a substantive question about the role they actually play rather than their job title. Early enforcement actions will generate test cases on the boundary of the definition, and those cases will take time to work through the courts. In the interim, boards and CFOs are operating without clear judicial guidance on exactly who falls within scope. The prudent governance response is to assume a wider rather than narrower senior manager population and to calibrate oversight and accountability structures accordingly. This is not over-caution. It is the appropriate response to genuine legal uncertainty during the period before the courts have established the boundaries of the definition through decided cases.

Apparent authority and the governance gap most organisations have not mapped

The apparent authority dimension of Section 250 deserves more attention than it has received in the commentary that has followed the Act’s implementation. Most governance discussions have focused on actual authority, which is intuitively understood: if a senior manager is authorised to take a particular action and commits an offence in taking it, the corporate is liable. The governance response to actual authority liability is relatively clear: define what each senior manager is authorised to do, monitor whether they operate within those boundaries, and address situations where they do not.

Apparent authority is more challenging because it is inherently relational. Apparent authority arises from what a reasonable third party would conclude about the scope of a senior manager’s authority, based on what the organisation has communicated, how the senior manager has been presented and permitted to operate, and what the organisational context leads a reasonable observer to expect. An organisation that has not clearly defined and communicated the limits of each senior manager’s authority, or that has permitted senior managers to operate in ways that imply a broader scope than formally authorised, is at elevated risk of apparent authority liability. The governance response to apparent authority exposure is an authority framework design exercise. Boards need to be able to identify what authority each senior manager holds, how that authority has been communicated internally and externally, whether there are gaps between what managers have formally been authorised to do and what they are perceived to be authorised to do, and whether there are situations where the organisation’s conduct has created an impression of authority that exceeds the intended scope. In many organisations, this exercise will identify significant gaps between the formal authority framework that exists on paper and the operational reality of how authority is exercised in practice.

How Section 250 interacts with existing compliance frameworks

Section 250 does not operate in isolation. It sits within a compliance landscape that already includes the failure to prevent fraud offence under the Economic Crime and Corporate Transparency Act 2023, the Bribery Act 2010’s failure to prevent bribery offence, the Criminal Finances Act 2017’s failure to prevent facilitation of tax evasion offence, and the Modern Slavery Act 2015’s transparency reporting obligations. For organisations operating in regulated sectors, it sits alongside the FCA’s Senior Managers and Certification Regime and equivalent frameworks in other regulated industries.

The interaction between Section 250 and the failure to prevent fraud offence under ECCTA is particularly important. The ECCTA failure to prevent fraud offence applies to specified economic crimes and allows a reasonable procedures defence. Section 250 now applies to all offences including the same economic crimes covered by ECCTA’s failure to prevent provisions, but without the reasonable procedures defence. This creates a two-tier liability landscape for economic crime: the ECCTA failure to prevent offence where reasonable procedures is a defence, and Section 250 where it is not.

The practical consequence is that an organisation with excellent anti-fraud procedures may successfully defend itself against a failure to prevent fraud charge under ECCTA while simultaneously facing liability under Section 250 for the same underlying conduct, because Section 250 does not require that the organisation failed to prevent anything. It simply requires that a senior manager committed an offence within the scope of their authority. The existence of preventive procedures is irrelevant to the Section 250 liability question, though it may be relevant to sentencing and the organisation’s relationship with enforcement authorities. This interaction illustrates why Section 250 cannot be managed by bolting additional provisions onto existing compliance programmes. It requires a fundamental reassessment of the corporate criminal liability landscape and the adequacy of the governance structures that address it.

The enforcement environment: what to expect

Section 250 has been in force for less than three months at the time of writing. No enforcement actions under the new regime have yet been publicly disclosed. The Serious Fraud Office’s Business Plan for 2026 to 2027 indicates a continued focus on corporate economic crime, and the expansion of the senior manager attribution model to all offences is likely to feature in enforcement strategy as the regime matures. The FCA, the Health and Safety Executive, the Environment Agency, the Information Commissioner’s Office, and other regulatory bodies with criminal enforcement powers will also be assessing how Section 250 affects their enforcement approach in their respective domains.

The early enforcement environment is likely to be characterised by test cases that establish the boundaries of the senior manager definition and the actual or apparent authority formulation. Those cases will shape the practical application of Section 250 in ways that cannot be predicted with certainty at this stage. What can be predicted with reasonable confidence is that enforcement authorities will be alert to the opportunity Section 250 provides to prosecute conduct that would previously have been shielded by the identification doctrine, and that organisations that cannot demonstrate credible governance of senior manager conduct will be in a more vulnerable position when enforcement actions arise.

The sentencing environment under Section 250 will also be relevant. While the provision itself provides no prevention procedures defence, the existence of a credible compliance and governance programme is typically treated as a mitigating factor in corporate prosecutions. Organisations that can demonstrate genuine governance commitment, even where it did not prevent the specific conduct in question, are likely to face more favourable treatment in sentencing than those that cannot. This is not the same as a defence. But in the enforcement environment that Section 250 creates, it is a meaningful distinction.

What this means for the CFO and the finance function

The CFO carries a specific and direct exposure under Section 250 that goes beyond the general corporate liability question. The CFO is almost certainly a senior manager within the Section 250 definition in any organisation of significant size. The CFO plays a significant role in the decision-making relating to the organisation’s financial management, reporting, and control functions, which in most large organisations constitute a substantial part of its activities. Any criminal offence committed by the CFO in connection with the exercise of that authority creates direct corporate criminal liability under Section 250.

More significantly for governance purposes, the CFO’s oversight responsibilities extend to individuals within the finance function who may themselves meet the senior manager definition. A head of financial reporting, a group financial controller, or a head of tax with significant decision-making authority over a substantial part of the finance function’s activities may all fall within the senior manager definition. Criminal conduct by any of these individuals in connection with the exercise of their authority creates Section 250 liability without any requirement to show that the CFO knew about it, approved it, or failed to prevent it.

The finance function’s specific exposure categories under Section 250 are broader than economic crime alone. Financial reporting offences including false accounting and misleading statements. Tax-related criminal provisions. Data protection offences where financial data is mishandled. Regulatory criminal provisions applicable to financial services activities. Employment law criminal provisions arising from how financial function personnel are managed. Each of these categories was previously governed by the narrower identification doctrine. Under Section 250 they all create corporate criminal liability through senior manager conduct.

The connection to Provision 29 of the UK Corporate Governance Code is direct and important. The material controls framework that Provision 29 requires boards to monitor and declare on is the same controls architecture that determines whether the organisation has adequate governance over the conduct of the individuals who can create Section 250 liability. A board that is building genuine Provision 29 compliance, with documented material controls definitions, systematic monitoring, contemporaneous evidence, and board-level oversight, is simultaneously building the governance infrastructure that reduces Section 250 exposure. A board treating Provision 29 as a reporting exercise is leaving both exposures inadequately addressed at the same time.

The governance response: what needs to happen now

The governance response to Section 250 needs to operate across four dimensions simultaneously. These are not sequential steps. They need to be addressed in parallel over the remainder of 2026.

• Senior manager population mapping: boards need a clear, documented, and regularly reviewed view of which individuals within the organisation meet the Section 250 senior manager definition. This requires a substantive assessment of actual roles rather than a review of job titles or organisational charts. The mapping needs to be conducted against the definition in the Act, considering who plays a significant role in the decision-making relating to, or the actual managing or organising of, a substantial part of the organisation’s activities. It needs to be reviewed when roles change, when organisational structures are modified, and when individuals’ actual responsibilities evolve beyond their formal remit.
• Authority framework design and documentation: for each individual identified as a senior manager, the actual scope of their authority needs to be defined, documented, and communicated. This means specifying what decisions each senior manager is authorised to make, what actions they are authorised to take, what requires escalation to a more senior level, and what is outside their scope regardless of circumstances. The apparent authority dimension requires additional attention: the organisation needs to assess whether there are gaps between formally documented authority and what senior managers are perceived to be authorised to do based on how they have operated historically. Those gaps need to be closed, documented, and monitored.
• Compliance programme recalibration across the full criminal risk universe: programmes designed primarily around economic crime risk need to be extended to address the full scope of criminal liability that Section 250 creates. This does not mean replacing existing economic crime compliance programmes. It means assessing which criminal offence categories create material senior manager liability exposure in the specific context of the organisation’s activities, and ensuring that the governance and compliance infrastructure addresses those categories with the same rigour that economic crime categories have historically received. Health and safety governance, data protection oversight, environmental compliance, and other non-economic crime categories need to be assessed for Section 250 exposure and addressed where the current programme is inadequate.

Board-level oversight integration: Section 250 is a board governance matter, not only a compliance matter. Boards need to receive regular reporting on the senior manager population, the authority framework, and any incidents or patterns that suggest senior managers may be operating outside their authorised scope or in ways that create criminal liability exposure. The audit committee’s remit needs to be assessed for adequacy in relation to Section 250 oversight. The risk register needs to incorporate Section 250 liability as a specific and assessed risk. The board’s oversight of the compliance programme needs to extend explicitly to the non-economic crime categories that Section 250 has brought within the corporate criminal liability regime.

The international dimension

Section 250 applies not only to UK-incorporated entities but to certain non-UK corporations and partnerships where the relevant conduct constitutes an offence under UK law. The specific conditions for extra-territorial application are complex and will require legal analysis in the context of specific organisations and their structures. However, the direction is clear: international businesses with UK operations, UK-based senior managers, or UK counterparties and customers cannot treat Section 250 as a UK-only domestic matter.

For multinational organisations, the governance response to Section 250 needs to address the UK-specific exposure within the context of a broader global compliance programme. This typically means identifying the UK-specific senior manager population within the global structure, assessing UK criminal liability exposure for each category of activity that UK-based or UK-affecting senior managers oversee, and ensuring that the UK governance response to Section 250 is integrated with rather than isolated from the organisation’s global compliance architecture.

For non-UK organisations that have historically treated UK compliance as a subsidiary matter managed by local legal counsel, Section 250 is a signal that UK corporate criminal liability requires board-level attention at the global level. The extension of senior manager attribution to all criminal offences means that the UK compliance posture of a non-UK group is now a matter of direct corporate criminal liability for the group itself, not only a matter for UK subsidiaries or UK management.

The governance question Section 250 is really asking

Section 250 does not create a new compliance obligation that can be satisfied by updating a policy document, appointing a new officer, or adding a module to the annual compliance training programme. It creates a fundamental challenge to the adequacy of the governance architecture through which boards exercise oversight of the conduct of the individuals who manage the organisation on their behalf.

The question Section 250 is really asking is one that boards need to be able to answer with specificity rather than policy language: does the board know who in this organisation can create corporate criminal liability under the new regime, does it understand the actual scope of authority each of those individuals exercises in practice rather than on paper, and does it have governance mechanisms in place that provide meaningful and evidenced oversight of how that authority is being used?

Most boards, if they answer that question honestly against the current state of their governance, will find that the answer is less clear and less complete than it should be. The identification doctrine that Section 250 replaces was narrow precisely because it provided a high bar for prosecutors. That bar no longer exists. The governance response to its removal needs to be a genuine redesign of how boards exercise oversight of senior manager authority, supported by documented evidence of that oversight, rather than a compliance exercise designed to record what already exists.

The organisations that address Section 250 as a governance priority in the second half of 2026 rather than a legal advisory matter to be reviewed periodically will be better positioned when the enforcement environment matures, when early test cases establish the boundaries of the regime, and when institutional investors and counterparties begin to assess Section 250 governance as part of their own due diligence on corporate governance quality. Raayzel works with boards, CFOs, audit committee chairs, and General Counsel to assess the governance implications of Section 250, map senior manager populations and authority frameworks, recalibrate compliance programmes across the full criminal risk universe, and design the board-level oversight structures that the new regime requires. The work is advisory and execution-oriented, calibrated to the specific governance architecture, operational complexity, and regulatory profile of each organisation.

Stay ahead of the UK corporate governance and compliance agenda.

Sign up for free insights and resources from Raayzel Business Consulting: https://lp.constantcontactpages.com/sl/sBV4psC/insights

Book a free 30-minute consultation with our Compliance Partner at Raayzel: https://calendly.com/raayzelconsulting/30min