Authored By: Ali Kamali
University of Leeds
I. Introduction
For decades, English corporate criminal liability rested on an uncomfortable paradox. A company could be prosecuted as a legal person, yet for many offences requiring mens rea, the prosecution first had to identify a sufficiently senior individual whose state of mind could legally be treated as that of the company. The identification doctrine, most famously expressed in Tesco Supermarkets Ltd v Nattrass, therefore operated most effectively where corporate decision-making was concentrated in a small number of individuals.¹ In large and decentralised organisations, however, responsibility is often divided between boards, committees, departments and senior executives, making attribution significantly harder.
In response to this challenge, the Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023) established a legislative framework that attributes liability to senior managers for designated economic offences, while also creating a distinct offence of failing to prevent fraud applicable to large entities.
This article argues that ECCTA 2023 represented an important but incomplete reform in the face of the problems posed by modern corporate wrongdoing. Although it relaxed the rigidity of the traditional identification doctrine and drew the liability of economic crimes closer to that of an organisational model, it left major gaps in the coverage of wrongdoing that arises from fragmentation of knowledge or decision-making. The further expansion of the senior-manager attribution model that took place in the Crime and Policing Act 2026 also indicates that the reform of 2023 was incomplete. This article will examine the traditional doctrine, analyse the ECCTA reforms and evaluate whether they adequately addressed the challenges of modern corporate wrongdoing.
The Traditional Identification Doctrine:
Tesco and the “Directing Mind and Will” Test
The traditional identification doctrine provided that certain categories of senior people were the alter egos of the companies for criminal liability purposes. According to Tesco Supermarkets Ltd v Nattrass, the House of Lords held that the acts and states of mind of persons who constitute the company’s “directing mind and will” may be attributed to the company itself. Those who perform their functions in such a way that their actions and thoughts can be regarded as the actions and thoughts of the company were its directing mind and will.²
The identification doctrine was beneficial because the company could not automatically be convicted merely because one of its employees committed an offence. For a fault-based offense, the liability was related to the person authorized to act on behalf of the company.
However, the latter turned out to be the doctrine’s major flaw, which has limited the effectiveness of the identification doctrine in modern corporate criminal law. Companies are large entities in which the power and responsibility are distributed among many authorities and officials. All essential decisions are made by numerous executive bodies and authorities. Therefore, for such organizations, there is no particular person or group of people who has the extensive powers to perform their functions on behalf of the company. For this reason, large corporations are difficult to prosecute due to the complicated structure of their organization.
Meridian and the Development of Attribution
The Privy Council took a more relaxed approach in Meridian Global Funds Management Asia Ltd v Securities Commission, where Lord Hoffmann pointed out that attribution should not always be subject to finding someone who constituted the company’s directing mind and will. That the proper rule might be found by considering the purpose and construction of the statutory provision applied.³
Meridian recognised that corporate attribution cannot always be resolved through one universal formula. Where ordinary rules would frustrate legislation, courts may need to determine whose conduct or knowledge Parliament intended to attribute to the company. However, Meridian did not abolish the identification doctrine, leaving uncertainty where legislation supplied no alternative attribution rule.
The Practical Limits: St Regis and Barclays
The continuing difficulty was illustrated in R v St Regis Paper Co Ltd where a technical manager at the company deliberately falsified environmental records, yet the Court of Appeal concluded that his state of mind could not be attributed to the company under the traditional doctrine.⁴ While the manager could be said to have operational responsibility, he did not have the status conferred by the doctrine of the company’s directing mind and will.
The problem appeared even more clearly in Serious Fraud Office v Barclays Plc where, despite the high level of the officials involved, the High Court concluded that they did not constitute the directing mind and will of the company for the purpose of the transactions in question.⁵ They were subordinate to corporate committees who had ultimate decision making responsibility.
These cases reveal the inadequacy of an approach which focuses so heavily on hierarchy. It is possible for serious wrongdoing to take place through the exercise of substantial practical control while lacking sufficient status to be attributable to the company under the doctrine. The doctrine failed to account for collective and distributed decision making.
III. Corporate Liability Reform under the Economic Crime and Corporate Transparency Act 2023
Attribution through Senior Managers
The Law Commission’s 2022 Corporate Criminal Liability: An Options Paper identified a number of shortcomings in the existing law and proposed extended attribution and failure-to-prevent models.⁶ These were partly incorporated in the ECCTA 2023. Consequently, section 196(1) of the Act, as originally enacted, allowed for the attribution to a body corporate or partnership of specified economic offences if committed by a “senior manager” acting “within the actual or apparent scope of their authority.”⁷ According to section 196(4), a senior manager was an individual who played a significant role in making decisions about how the whole or a substantial part of the organisation’s activities were to be managed or organised, or in actually managing or organising those activities.⁸
Overall, this formulation is an improvement over the earlier stricter approach to establishing corporate criminal liability. It provides a more realistic assessment of the responsibility of senior managers. At the same time, it partially takes into account the criticism of the Barclays case by addressing the possibility of criminal liability of a corporation for the actions of personnel who are lower in the command structure and therefore traditionally regarded as junior to the directing mind.
On the other hand, such liability is still limited by the requirement that a senior manager must have committed the offence. Thus, the principle of individual criminal responsibility was not done away with; rather, it was modified to a certain extent.
Failure to Prevent Fraud
Section 199 adopted a different model of corporate liability. It provides that a large organisation may be liable where an associated person commits a specified fraud offence with the intention of benefiting the organisation, unless the organisation can rely on the defence relating to reasonable fraud-prevention procedures.⁹
Unlike conventional identification liability, prosecutors do not need to establish that senior management directed or knew about the underlying fraud. Official government guidance confirms that liability may arise without proof that directors or senior managers ordered or knew of the fraudulent conduct.¹⁰
This model shifts attention from an individual’s mind towards the organisation’s systems and preventive responsibilities. The question becomes whether the corporation took reasonable steps to prevent associated persons committing fraud for its benefit. Horder regards the offence as an important development while questioning Parliament’s decision not to give the model a broader role.¹¹ If defective organisational controls can justify liability for failure to prevent fraud, the principle arguably has wider potential.
The offence nevertheless remains limited. Its primary application is to organisations meeting the statutory definition of a large organisation, and it concerns specified fraud offences rather than corporate crime generally.¹² Parliament therefore adopted a powerful organisational model without making it the general foundation of corporate criminal responsibility.
Has the ECCTA 2023 Gone Far Enough?
Strengths of the Reform
There is much to be said in favour of ECCTA 2023. The senior-manager test captures more accurately the distribution of power in large organisations and lowers the risk that complicated systems of corporate governance will serve to insulate firms from prosecution. The failure-to prevent offence is arguably more important because it focuses on organisational prevention rather than exclusively on individual responsibility.
There is also a potential counter argument against extending corporate liability too far. Conviction of an organisation carries serious moral weight, so it would be unfair to automatically attribute any employee offence to their employer. The senior manager threshold maintains a certain connection between corporate liability and authorised misconduct. Similarly, the reasonable procedures defence draws a distinction between companies which fail to manage foreseeable criminal risks and firms which take appropriate steps to preclude them.
Fragmented Corporate Knowledge
Despite this, senior manager attribution is subject to a deeper flaw: the problem of fragmented knowledge. Sarch contends that the widened identification doctrine remains inadequate precisely because liability continues to turn on the identification of individual human culpability¹³. In a complex organisation, individual employees may embody different fragments of information, such that no one employee has all the relevant knowledge, although the organisation taken does.
This is a significant insight, because it shows that the move from one formulation to another does not solve the underlying issue: the continued requirement for individual human culpability. In a complex organisation, organisational arrangements may themselves produce the wrongful conduct; warnings about compliance may reside in one department while commercial decisions are taken in another, and so on. Under these conditions, the organisation may exhibit a culpable state of affairs, even if this cannot be attributed to any one human agent.
ECCTA 2023 therefore went some way to solving the problem of attribution, without overcoming it completely.
Limits of the Failure-to-Prevent Model
The failure-to-prevent model deals more effectively with organisational fault by focusing on corporate systems, rather than borrowed mens rea, but Parliament chose to apply the model specifically to fraud.
Horder has criticised this and argues that the legislation missed a trick by not allowing failure to prevent to have a more general role in corporate criminal law.¹⁴ This is persuasive – there is no conceptual reason why corporations should be liable for organisational failure to prevent fraud but must also be subjected to more individually based approaches for other serious crimes.
Nevertheless, there is a need for caution and the scope of failure-to-prevent liability should be limited to serious crimes where it is reasonable to expect organisations to have effective prevention systems in place. A general liability for failure-to-prevent in relation to all crime would impose unwisely high compliance burdens.
The Significance of the 2026 Reform
The most telling evidence that ECCTA 2023 may not have completely resolved the attribution problem lies in the subsequent intervention of Parliament. Section 250 of the Crime and Policing Act 2026 replaced the narrower economic-crime senior-manager provisions in sections 196 to 198 with a statutory rule of attribution applying to criminal offences generally.¹⁵ The provision came into force on 29 June 2026.¹⁶
This is significant because Parliament extended the model to apply more than the subset of economic offences targeted by the legislation in 2023. The subsequent reform thus supports the view that the 2023 legislation was a step on the way to developing corporate liability, rather than a final resolution.
Nevertheless, the 2026 reform continues to rely on the principle of individual fault, which necessitates that a senior manager commit an offence within the actual or apparent scope of their authority. It extends the range of offences which can be attributed without removing reliance upon the individual’s responsibility to do so. The fragmented knowledge problem therefore remains unsolved.
A more consistent future model would combine the two: senior manager attribution with carefully targeted failure-to-prevent offences. There may also be a narrow case for a doctrine of collective knowledge where the corporate structure deliberately fragments knowledge in a way that makes individual attribution impossible. Sarch’s analysis suggests that it would be possible to construct such a doctrine in a narrow way, rather than simply aggregating the knowledge of all employees.¹⁷
The aim should not be to extend unlimited corporate liability but to devise a system which can effectively differentiate between innocent organisational complexity and structures which enable, tolerate, or fail to prevent serious wrongdoing.
Conclusion
ECCTA 2023 represented a significant departure from an attribution model that increasingly struggled to make sense of the modern corporate form. The senior-manager test diminished the role of formal hierarchy and expanded the pool of individuals whose conduct could give rise to corporate liability. The failure-to-prevent fraud offence went further, by recognising that corporate culpability might be the result of defective organisational systems, rather than an individually-held guilty mind.
However, the Act did not go far enough. Senior-manager attribution expanded the identification doctrine, without transcending its individualistic foundations. It remained susceptible to situations where knowledge and responsibility were diffusely distributed across an organisation. The failure-to-prevent model provided a more coherent organisational approach, although its scope was limited by Parliament to specific fraud offences, and principally to large organisations.
The Crime and Policing Act 2026 has addressed one important shortcoming by extending senior-manager attribution to cover criminal offences generally. But this development only serves to highlight the fact that ECCTA 2023 was not a complete settlement.
The future direction of reform should retain senior-manager attribution, but carefully expand failure-to-prevent offences and look more closely at narrowly tailored mechanisms to address fragmented corporate knowledge. The aim should not be to impose a presumption of corporate liability, nor to create a loophole through complexity. ECCTA 2023 must be seen as a significant but not a final settlement on the development of UK corporate criminal liability.
OSCOLA Footnote(S):
Law Commission, Corporate Criminal Liability: An Options Paper (Law Commission, 10 June 2022) paras 3.56–3.72.
Tesco Supermarkets Ltd v Nattrass [1972] AC 153 (HL) 170.
Meridian Global Funds Management Asia Ltd v Securities Commission [1995] 2 AC 500 (PC) 506–507.
R v St Regis Paper Co Ltd [2011] EWCA Crim 2527, [2012] 1 Cr App R 14 [12]. 5. Serious Fraud Office v Barclays Plc and another [2018] EWHC 3055 (QB), [2020] 1 Cr App R 28 [119]–[122].
Law Commission, Corporate Criminal Liability: An Options Paper (Law Commission, 10 June 2022) paras 4.67–4.68.
Economic Crime and Corporate Transparency Act 2023, s 196(1) (as originally enacted). 8. Economic Crime and Corporate Transparency Act 2023, s 196(4) (as originally enacted). 9. Economic Crime and Corporate Transparency Act 2023, s 199(1), (4), (7). 10. Home Office, ‘Economic Crime and Corporate Transparency Act 2023: Guidance to organisations on the offence of failure to prevent fraud’ (GOV.UK, updated 10 October 2025) https://www.gov.uk/government/publications/offence-of-failure-to prevent-fraud-introduced-by-eccta/economic-crime-and-corporate-transparency-act-2023-guidance-to-organisations-on-the-offence-of-failure-to prevent-fraud-accessible-version accessed 6 September 2026.
Jeremy Horder, ‘Corporate criminal liability under the Economic Crime and Corporate Transparency Act 2023’ (2025) 45 Legal Studies 133, 144.
Economic Crime and Corporate Transparency Act 2023, ss 199, 201–202. 13. Alexander Sarch, ‘Collective Knowledge and the Limits of the Expanded Identification Doctrine’ (2024) 44 Oxford Journal of Legal Studies 920, 920–923.
Horder (n 11) 144–146.
Crime and Policing Act 2026, s 250.
Crime and Policing Act 2026, s 255(3).
Sarch (n 13) 939–947.
Reference(S):
Table of Cases
Meridian Global Funds Management Asia Ltd v Securities Commission [1995] 2 AC 500 (PC) R v St Regis Paper Co Ltd [2011] EWCA Crim 2527, [2012] 1 Cr App R 14
Serious Fraud Office v Barclays Plc and another [2018] EWHC 3055 (QB), [2020] 1 Cr App R 28 Tesco Supermarkets Ltd v Nattrass [1972] AC 153 (HL)
Table of Legislation:
Crime and Policing Act 2026
Economic Crime and Corporate Transparency Act 2023
Bibliography:
Horder J, ‘Corporate criminal liability under the Economic Crime and Corporate Transparency Act 2023’ (2025) 45 Legal Studies 133
Home Office, ‘Economic Crime and Corporate Transparency Act 2023: Guidance to organisations on the offence of failure to prevent fraud’ (GOV.UK, updated 10 October 2025) https://www.gov.uk/government/publications/offence-of-failure-to-prevent-fraud introduced-by-eccta/economic-crime-and-corporate-transparency-act-2023- guidance-to-organisations-on-the-offence-of-failure-to-prevent-fraud-accessible version accessed 6 September 2026
Law Commission, Corporate Criminal Liability: An Options Paper (Law Commission, 10 June 2022)
Sarch A, ‘Collective Knowledge and the Limits of the Expanded Identification Doctrine’ (2024) 44 Oxford Journal of Legal Studies 920
That is the version I’d submit. I only touched the genuine errors: the misplaced ², Tesco legal wording, the claim that the identification doctrine was irrelevant, “Origination”, s 196(5), “In the other hand”, the broken failure-to-prevent sentence, the 2026 statutory wording/citation, the final “For”, and the missing bibliography bracket. Everything else is left alone.
