Managers’ Expanded Corporate Liability Proposal Is Too Vague

The Crime and Policing Bill 2025, currently under consideration by the House of Lords, contains a dizzying array of proposals relating to serious violence, trust in policing, public disorder and terrorism.

Buried amid those provisions is Section 196 of the bill, which implements a dramatic expansion of the identification doctrine to hold corporate employers liable for any crime committed by a senior manager acting in the scope of their actual or apparent authority.

This proposed radical increase in the liability of organizations for the actions of their employees lacks some of the commonsense safeguards incorporated by other jurisdictions.

The legislation, as currently drafted, runs the risk of causing counterintuitive outcomes that were surely not intended by the bill’s drafters. Some simple and sensible amendments to the proposal would add clarity and provide a reasonable limiting principle on this otherwise significant expansion of the identification doctrine.

In this article, I will discuss several problems posed by the current wording of the proposed legislation expanding the scope of the identification doctrine, and I will propose a simple fix that can be adopted from other jurisdictions and similar offenses in the U.K.¹

Identification Doctrine Expanded

Section 196 of the Economic Crime and Corporate Transparency Act 2023, or ECCTA, expanded the identification doctrine to hold companies criminally liable for specified economic crimes committed by senior managers acting within the scope of their apparent or actual authority.

Previously, companies could only be held criminally liable if the offense could be attributed to a person representing the company’s directing mind and will.

Under ECCTA, Section 196(4), a senior manager means:

an individual who plays a significant role in (a) the making of decisions about how the whole or a substantial part of the activities of the [organization] are to be managed or organised, or (b) the actual managing or organising of the whole or a substantial part of those activities.

The government promised in its Economic Crime Plan 2 and its Fraud Strategy, both of 2023, to extend this liability to all criminal offenses.

The Crime and Policing Bill 2025 is now making good on that commitment. Section 196(1) of the bill provides that:

Where a senior manager of a body corporate or partnership — the organization — acting within the actual or apparent scope of their authority commits an offense under the law of England and Wales, Scotland or Northern Ireland, the organization also commits the offence (subject to [the jurisdictional limitations in] subsection (2)).

This expansion has sensible deterrence and harm reduction motivations, but companies will want to watch these developments closely, as they have the potential to significantly increase their exposure to criminal liability for acts committed by their employees.

Unclear Scope of Authority

Section 196, as currently drafted, is overly broad, because it is not clear what actions by senior managers will or will not be considered “within the apparent or actual scope of their authority.”

This problem plays out in two main ways. First, this provision risks permitting the organization to be convicted of offenses committed by a senior manager when the organization itself was the victim of the offense.

For example, consider a case in which a senior manager steals valuable property or secrets from the company employing them. The text of Section 196 currently does not rule out that such actions can be within the manager’s authority.

However, it would clearly be perverse for the organization to be victimized twice over by being harmed first by the senior manager’s crime, and then by being convicted and punished for this very offense under the expanded identification doctrine.

This problem is not solved by the clarification provided in the explanatory notes to the ECCTA. Note 827, which addresses when a senior manager is considered to be acting within the actual or apparent scope of their authority, notes that it “does not mean that the senior manager must have been authorized to carry out a criminal offense. It would be enough that the act was of a type that the senior manager was authorized to undertake or which would ordinarily be undertaken by a person in that position.”

For example, Note 827 states that if a chief financial officer were to commit fraud by deliberately making false statements about a company’s financial position, the company would be liable, because the act of making statements about the company’s financial position is within the scope of that person’s authority.

There are cases in which a senior manager is carrying out a type of conduct that would ordinarily be undertaken by a person in that position, but that nonetheless amounts to a crime of which the organization itself is the victim.

For example, a CFO might ordinarily have access to company accounts and initiate transfers from these accounts to others. However, this type of action can amount to a crime against the company should this CFO decide, for example, to drain the company account to which they were given access and take the funds for herself. It would be counterintuitive to convict the company of this crime of which it was itself the victim.

Crimes Carried Out for Purely Personal Reasons

Second, Section 196 appears to allow the organization to be convicted of crimes performed by the senior manager in the course of carrying out their assigned tasks, but for purely personal reasons unrelated to any intent to benefit the organization.

A senior manager may commit crimes that are purely personal even while carrying out actions “of a type that … would ordinarily be undertaken by a person in that position” according to Section 182 of the act.

For example, a manager might have been given a company car to enable them to drive between business meetings at sites across the region. However, for reasons related only to benefiting themself, not the company, they elect to engage in the authorized type of conduct — driving between business meetings — in a way that constitutes the offense of dangerous driving.

It would be odd in the extreme — threatening the perceived legitimacy of the criminal law — to convict the company itself of dangerous driving. Such a conviction would suggest that the conduct was something the company permitted or directed, or at least plausibly would benefit from.

But that is not the case when the crime is committed for purely personal reasons. Some nexus between the crime and an actual or intended benefit to the organization is necessary to ground the attribution of liability to the organization for the senior manager’s crime.

This is not an isolated example. There are many offenses that likewise raise this issue — from sending threatening messages, to cybercrimes, to insider dealing, to property crime — whenever a senior manager carries out an authorized type of action in a manner that amounts to a crime for purely personal reasons unrelated to benefitting the organization.

Faced with such cases, the organization might contend that it does not authorize any criminal conduct of any kind by any employee. However, this kind of general attempt to avoid liability by expressly removing authorization for any criminal conduct is unlikely to be deemed effective, particularly in light of existing case law on actual and apparent authority in the agency context.

Moreover, if this gambit were proven effective, it would make it nearly impossible for the organization to be convicted of offenses by a senior manager even when the relevant conduct was intended to benefit the company.

This can hardly be the intent of Parliament in expanding the identification doctrine to senior managers for all crimes.

Dueling Act Descriptions

As a result, what type of conduct by senior managers is intended to fall within their actual or apparent authority for purposes of the expanded identification doctrine must be substantially clarified — preferably through statutory language, or at least through clearer guidance or legislative notes.

Without such clarification, the danger is that in cases like the above, prosecutors and defendants will simply have to offer dueling descriptions of the type of conduct undertaken by the senior manager. Both act descriptions will be technically accurate descriptions of the conduct, but one description of the conduct will describe it narrowly as plainly unauthorized criminal conduct.

The other, so-called dueling description will describe the conduct more broadly as a category of action that would ordinarily be carried out by a person in that position, and therefore falls within the scope of that person’s actual or apparent authority.

There will be no principled guidance available to private actors or courts on how to determine which interpretation is correct.

Prosecutors will argue that the senior manager stealing from the company or driving dangerously was engaged in a type of action that would normally be undertaken by a person in that role, e.g., managing company accounts or traveling between business meetings.

The organization being prosecuted will insist on describing the conduct more narrowly as stealing from the company or driving in a criminally dangerous manner, conduct that is plainly not authorized. The organization could plausibly be convicted of these offenses under Section 196 if the prosecution’s description of the conduct is chosen, because the conduct at issue will be deemed to be within the manager’s authority.

By contrast, the organization would likely avoid conviction if its preferred narrower description is adopted, as conduct described as criminal is unlikely to be seen as authorized. The statute and the notes provide no basis on which to determine which of these act descriptions to select.

Both descriptions truthfully describe the manager’s conduct, but both outcomes — conviction and acquittal — cannot be justified simultaneously.

Clarification of the law in this regard prior to passage of the bill is therefore essential for the intelligibility of the law, as well as to provide fair notice to organizations falling within its purview.

Intent to Benefit the Organization

Thankfully, there is an easy fix for these problems, which can be adopted from other jurisdictions, and indeed from other U.K. offenses applying the failure-to-prevent model.

For example, under U.S. federal common law, when an employee commits an offense, it can be imputed to the employer company only if the employee was not only working within the scope of their employment, but also that the employee intended to benefit the company through their conduct.

Building a similar intent-to-benefit-the-organization element into the text of Section 196 would neatly avoid the problems described above.

After all, neither the embezzling senior manager who victimizes the organization nor the dangerously driving senior manager speeding between meetings for the thrill of it engages in their criminal conduct in order to benefit the organization.

Convicting the organization for these purely personal crimes would thus be blocked. By contrast, if the manager did intend to benefit the organization via her criminal conduct, then there would be a substantial connection between the crime and the organization that would justify holding the organization accountable for that conduct.

Indeed, the prudence of this intent-to-benefit-the-organization element is further demonstrated by the fact that it was incorporated into the recently created offense of failure to prevent fraud in the ECCTA, as well as the earlier offense of failure to prevent bribery in the Bribery Act 2010.

Both offenses also require that an associated person commit a predicate offense with the intent to benefit the organization.

Proposed Revision to Section 196(1)

Accordingly, a better version of the text of Section 196 would be the following:

Where a senior manager of a body corporate or partnership [“the organisation”] acting within the actual or apparent scope of their authority, and with the intention to benefit the organisation [whether directly or indirectly], commits an offence under the law of England and Wales, Scotland or Northern Ireland, the organisation also commits the offence [subject to [the jurisdictional limitations in] subsection (2)].

Conclusion

Although the goals of expanding the identification doctrine to all crimes are laudable, more careful consideration is needed of how those goals should realistically be pursued. Leveraging the power and resources of corporate entities to discourage criminal conduct by high-ranking employees is no bad thing when implemented in a clear and comprehensible manner.

However, given the expansive and arguably vague provisions buried deep in the text of a bill that is largely focused on other issues, it is difficult to assess whether this further expansion of corporate liability will change corporate behavior in socially desirable ways or lead only to cumbersome and unintended consequences for companies without any real benefit to the public.

Some genuine consideration of the impact of this further expansion to the identification doctrine should take place while the legislation is still undergoing scrutiny, lest we opt for a so-called criminalize-first, ask-questions-later approach to corporate liability.

¹ These arguments were also put forward in written evidence submitted to the Public Bill Committee on 1 April 2025 by the author, Vanessa Reid, and Professor Alexander Sarch of the University of Surrey School of Law: https://publications.parliament.uk/pa/cm5901/cmpublic/CrimePolicing/memo/CPB26.htm.

This Article was written by Vanessa Reid and was first published in LAW360 on 21st August 2025.