[co-author: Alex Cumming]
The Crime and Policing Bill has now made it through the House of Lords committee, and the current version contains clause 213, which would make an organisation criminally liable where a senior manager commits any offence while acting within the actual or apparent scope of their authority. That makes it increasingly realistic that this becomes law, so it is no longer sensible to treat it as a purely academic risk. The difficulty is that the breadth of the drafting creates edge cases that look untethered from the policy aim of improving corporate accountability for serious wrongdoing.
This is a major shift. The senior manager attribution model is already in place for specified economic crimes under the Economic Crime and Corporate Transparency Act 2023, reflecting a long-standing enforcement challenge with the identification doctrine in large organisations. Clause 213 would take that same approach and extend it beyond economic crime to all offences.
The breadth of clause 213 carries consequences that can look, in places, conceptually strained. Those consequences matter more now because the provision has survived into the Lords text at a relatively late stage, with committee scrutiny already completed.
The key change
Clause 213 provides that where a senior manager of a body corporate or partnership, acting within the actual or apparent scope of their authority, commits an offence under the law of England and Wales, Scotland or Northern Ireland, the organisation also commits the offence.
The definition of “senior manager” is functional, not title based. It captures an individual who plays a significant role in decision making about how the whole or a substantial part of the organisation’s activities are managed or organised, or in the managing or organising of those activities.
Why this is now a live issue
The Bill’s momentum matters. Corporate criminal liability reform is no longer confined to policy papers and consultation. Clause 213 is in the latest published Bill text and has been debated in Lords committee, which involves a detailed, line-by-line examination. Typically, the biggest structural changes to a bill usually occur during the committee stage.
That does not mean the clause is guaranteed to become law unchanged. It can still be amended at Lords report stage (which commences on 25 February 2026) and during any later Commons or Lords stages. But the direction of travel is now clearer, and businesses should plan on the basis that some form of ‘all offences’ senior manager attribution is likely to land.
What does this mean in practice?
The policy aim is intuitive when you have in mind serious corporate wrongdoing committed by influential decision makers. The difficulty is that clause 213 is not limited to serious wrongdoing, not limited to economic crime and not expressly conditioned on a benefit to the organisation. On its face, it attaches to any criminal offence.
The edge cases
It is easy to see why lawyers reach for odd edge cases first. On the face of the clause, if a senior manager commits an offence within actual or apparent authority, the organisation commits it too. Three examples show how quickly that can start to feel strained.
1. The busking CFO
The CFO decides to play music in the company foyer during a charity fundraiser with clients present. Local rules require a licence, no licence is obtained and an offence is made out. Potential individual offence: Licensing Act 2003 s136 (unauthorised licensable activities). Corporate exposure under clause 213: the CFO is a senior manager and hosting a company event at company premises sits within at least apparent authority.
2. Marketing meets motorway
A senior marketing manager authorises a guerrilla marketing stunt involving a pop up installation on or near a public highway. It blocks traffic for a short period and the individual is charged with obstructing a highway. Potential individual offence: Highways Act 1980 s137 (wilful obstruction). Corporate exposure under clause 213: marketing stunts fall squarely within apparent commercial authority.
3. Fireworks on the roof
An events manager approves a rooftop fireworks display for a corporate celebration. Licensing conditions are not met and safety requirements are breached. Potential individual offence: Fireworks Regulations 2004 reg 9 and/or Explosives Regulations 2014 (licensing related offences, commonly cited as reg 9, depending on the activity). Corporate exposure under clause 213: the decision is taken as part of corporate hospitality or events, so it is within actual or apparent authority.
Realistic routes to liability
The more important point is that the same attribution pathway would apply to conduct that UK enforcement agencies will care about, and where there is a realistic enforcement angle. These are the kinds of scenarios boards and compliance teams should have in mind.
1. Modern slavery in the supply chain
A regional operations head ignores forced labour among subcontractors or labour providers. Potential individual offence: Modern Slavery Act 2015 s1 (slavery, servitude and forced or compulsory labour). Corporate exposure under clause 213: supply chain oversight is within operational authority and the individual sits at senior management level.
2. Human trafficking linked to recruitment or labour sourcing
A recruitment manager responsible for overseas recruitment engages agents who charge unlawful fees or facilitate trafficking. Potential individual offence: Modern Slavery Act 2015 s2 (human trafficking). Corporate exposure under clause 213: recruitment and labour sourcing sit within apparent authority and third parties would assume the manager can engage agents.
3. Competition related criminal exposure
A senior commercial manager becomes involved in bid rigging or market allocation. Potential individual offence: Enterprise Act 2002 s188 (cartel offence). Corporate exposure under clause 213: pricing and bidding decisions sit within apparent commercial authority, even if the company’s internal policies prohibit the conduct.
4. Data protection offences
A senior manager directs the misuse of customer databases for purposes outside lawful processing. Potential individual offence: Data Protection Act 2018 s170 (unlawful obtaining or disclosure of personal data) and, depending on the fact pattern, related offences. Corporate exposure under clause 213: directing data use sits within at least apparent authority for a senior manager responsible for data driven activity.
5. Computer misuse
A senior manager commissions or directs unauthorised access to computer material, for example through credential sharing or instructing contractors to extract data behind authentication. Potential individual offence: Computer Misuse Act 1990 s1, and potentially s2 or s3 depending on intent and impact. Corporate exposure under clause 213: the instruction is given in a business context by a senior manager and can look within apparent authority even if technically unauthorised.
None of these examples are meant to suggest that enforcement agencies will prosecute every marginal case. The point is that clause 213 changes the attribution pathway. Conceptually, “the organisation committed the offence” can still sound strained in some scenarios, and the breadth continues to produce oddities at the edges. Practically, the exposure affects investigations, charging leverage, self-reporting decisions and insurance and governance discussions.
Three features drive most of the concern:
- No offence limitation. It would apply to any offence, not just a defined category.
- Apparent authority. Liability would turn on what others could reasonably think the senior manager was empowered to do, not what was actually approved.
- No reasonable procedures defence. Unlike failure to prevent regimes, there is no statutory defence based on reasonable prevention measures in the drafting. The organisation’s systems may be relevant at sentencing, but they do not stop primary liability attaching in the first place.
This is why the reform can feel, in some respects, internally inconsistent. Clause 213 is framed as a corporate accountability measure, but it can also operate as a form of broad attribution that is hard to reconcile with fair labelling when applied to the kinds of offences above.
What should companies do now?
Given where the Bill is, it is sensible to take preparatory steps that are low regret, without over engineering to a text that could still change. In practice, many organisations should already be doing much of this work under the existing ECCTA 2023 senior manager attribution regime for economic crimes; clause 213 extends the same discipline to a wider offence set.
Practical steps that would make sense now:
- Track amendments to the Bill at Lords report stage and plan ahead as to how the provision will affect your business if it stays intact.
- Map who could realistically fall within “senior manager” across the group, including regional heads and functional leaders who make decisions over a substantial part of activities.
- Review delegations and approval processes for higher risk operational decisions, especially marketing, events, sites and public facing activity where apparent authority risk is highest.
- Stress test escalation routes so that senior managers have clear points of contact when a decision strays into legal risk territory.
- Integrate the expansion to senior manager liability with existing training programmes.
If clause 213 does become law in broadly this form, many organisations will also want to revisit their incident response playbooks and investigation protocols, because corporate exposure may attach earlier and in a wider set of fact patterns than under the current economic crime-only senior manager regime.
[View source.]
