The Crime and Policing Act 2026: What “Failure to Prevent Crime” Now Means for SMEs

The Crime and Policing Act 2026 (PCA), which received Royal Assent on 29 April 2026, marks a further shift in UK corporate criminal liability. Even though we have recently seen piece by piece changes in specific areas such as bribery, tax evasion and fraud –  this is perhaps the most significant, and it has come in under the radar for those not in legal practice.

While much commentary has focused on large corporates in recent years (with failing to prevent fraud only applicable to businesses turning over in excess of £36m), the new regime has profound implications for all businesses – especially small and medium‑sized businesses (SMEs) which may not have in place any suitable framework.

In particular, the Act radically changes how crimes committed by senior managers can be attributed to the business itself, fundamentally altering the risk landscape for owner‑managed and growing organisations.

For many years the Government (following a number of high profile failed investigations) has sought to find away to hold corporate entities to account for criminal acts committed within their structure. The age old doctrine of “directing mind and will” proved very difficult for prosecutors to get over the line. Slowly that doctrine had been eroded – making it an offence of the corporate if it failed to prevent specific offences from occurring on its watch.

Section 250 of the PCA has effectively reworded the Economic Crime and Corporate Transparency Act 2023 (ECCTA) to remove reference to “economic crime” – thus creating a single provision that will apply to all criminal offences:

Where a senior manager of a body corporate or partnership (“the organisation”) acting within the actual or apparent scope of their authority commits an offence under the law of England and Wales, Scotland or Northern Ireland, the organisation also commits the offence.

The legislation around failing to Prevent Fraud under S.199 ECCTA remains unchanged and therefore that aspect still applies to all large businesses. Under S.199 a large company will commit the failing to prevent fraud offence if there are no reasonable prevention procedures in place,

The PCA does not introduce a general “failure to prevent crime” offence for SMEs but it dramatically erodes the practical distinction between direct liability and failure‑to‑prevent models.

For SMEs where senior managers often exercise wide operational authority, the exposure is real and immediate. There is no defence available to the corporate of reasonable prevention or procedure. If the senior manager is convicted – so too can the company.

From “Directing Mind and Will” to Senior Manager Attribution

Historically, prosecutors relied on the common‑law identification doctrine, requiring proof that a company’s “directing mind and will” (typically a board‑level director) committed the offence. This standard was notoriously difficult to meet, particularly where the company has a complex structure.

That position has now changed. The Crime and Policing Act 2026 extends the senior manager attribution model, previously limited to certain economic crimes under the Economic Crime and Corporate Transparency Act 2023.

This now applies to almost all criminal offences.

A company can therefore commit a criminal offence if:

• a senior manager commits the offence; and
• they do so within the actual or apparent scope of their authority.

Crucially, this is a functional test, not a title‑based one. A “senior manager” is anyone who plays a significant role in managing or organising all or a substantial part of the organisation’s activities. In SMEs, this may include finance directors, operations heads, regional managers, or even founders themselves.

What this is intended to do is narrow the gap where investigators and prosecutors have struggled in the past – where criminal wrongdoing has taken place by a person with authority but not at an identifiable board level.

What this means is that businesses of all sizes will now need to assess the function of their senior staff – not simply acknowledging a job tile or looking at a reporting line.

As mentioned above it does not provide the company with a reasonable procedure defence.

Why This Matters More for SMEs Than Large Corporates

While large organisations face broader enforcement risk by volume, SMEs face greater proportional exposure. In many SMEs:

• Senior managers may hold wide, undocumented delegations of authority
• Compliance functions may be informal or non‑existent
• Operational decisions frequently blur the line between strategic and day‑to‑day management
• Small but fast growing businesses often cannot keep up with necessary changes or maintain proper oversight

As a result, a single criminal act by a senior individual may now include the following exposure to the company as well (non-exhaustive):

• Fraud
• Environmental / ESG offences
• Health and safety breaches
• Modern slavery
• Supply chain issues
• false accounting—may now automatically implicate the company itself, without the need for prosecutors to prove systemic failure or board‑level knowledge.

Taken as a whole this clearly demonstrates that there has been a (further) significant shift in how corporate entities are to be held to account for criminal wrongdoing.

This shift cannot be underestimated and represents a whole new era of corporate criminal liability, replacing that which has been around for nearly a century.

A De Facto “Failure to Prevent” Regime

As mentioned the PCA does not create a universal failure‑to‑prevent offence. In practice is seems that it will produce a similar outcome, only without a statutory defence.

Under existing failure‑to‑prevent models (bribery, facilitation of tax evasion, and fraud), organisations may avoid conviction by demonstrating that they had reasonable or adequate prevention procedures in place. By contrast, senior manager attribution carries no such defence. If the offence is proved, liability follows—even where robust compliance systems existed.

For SMEs, this creates a harsh reality:

• prevention measures do not negate liability; but
• absence of such measures vastly increases the likelihood of criminal conduct occurring in the first place.

In effect, SMEs are expected to behave as though subject to a failure‑to‑prevent regime, but without that important safety net.

Senior Managers now the Primary Risk

The PCA reflects a clear policy choice: criminal risk now attaches to where real decision‑making power lies, not simply to those at the apex of corporate hierarchies.

For SMEs, senior managers often:

• approve payments and contracts;
• oversee regulatory compliance;
• manage health and safety or environmental controls; and
• interact directly with customers, suppliers, and public bodies.

Crimes that may be committed by senior managers—and now attributed to the company will include (again non-exhaustive):

• Fraud and False Representation
• Data and Cyber Offences
• Health and Safety
• Environmental crimes
• Money Laundering failures
• Sanctions Breaches
• Regulatory Conduct

Importantly, the offence need not benefit the business. It is sufficient that the senior manager acted within their apparent authority.

Governance: The New Front Line of Defence

While SMEs cannot rely on “adequate or reasonable procedures” as a formal defence, evidence of good governance will still play a decisive role in enforcement decisions, charging discretion, and sentencing.

Prosecutors are increasingly expected to ask:

• Who exercised decision‑making authority in practice?
• Were responsibilities clearly defined and recorded?
• What supervision, challenge, or escalation mechanisms existed?

SMEs that lack:

• Good governance
• Role clarity
• Documented delegations of authority,
• Training records, or
• Internal reporting processes

will find it significantly harder to argue that criminal conduct was aberrational or unforeseeable—even if liability is already technically established.

Practical Steps SMEs Should Take Now

In light of the Act, SMEs should urgently consider the following actions:

1. Map out and assess senior manager roles in practice – not just on charts and organograms
2. Document decision‑making authority
3. Expand risk assessments beyond economic crime, including health and safety, environmental, and regulatory risks
4. Train senior managers on personal and corporate criminal exposure
5. Implement clear escalation and whistleblowing mechanisms
6. Review D&O insurance in light of increased investigation risk

While these steps cannot eliminate liability, they may significantly reduce the likelihood of criminal conduct and mitigate enforcement consequences.

Conclusion

The Crime and Policing Act 2026 represents a paradigm shift in UK corporate criminal law. For SMEs, the expansion of senior manager attribution effectively introduces a failure‑to‑prevent mindset—even in the absence of a formal offence or defence.

Senior managers are now the primary conduit through which criminal liability may be exposed. SMEs that fail to recognise and address this reality face heightened enforcement risk, reputational damage, and potentially devastating financial consequences.

In this new landscape, doing nothing is no longer a neutral option.

Contact John Hartley, Head of Regulatory and Business Crime, via john.hartley@primaslaw.co.uk.