This Precedent is designed to help you map how significant decision-making authority is exercised throughout your organisation. It is designed to be used alongside Precedents: • Corporate criminal liability—senior manager identification spreadsheet • Corporate criminal liability—risk assessment • Corporate criminal liability—risk management plan Senior manager attribution under section 250 of the Crime and Policing Act 2026 (CPA 2026) means that an organisation may be criminally liable where a senior manager commits an offence while acting within the actual or apparent scope of their authority. Identifying senior managers requires an understanding of how the organisation is managed

This Practice Note explains the identification principle in criminal law and how it is used to attribute criminal liability to corporate bodies. It covers the meaning of the directing mind and will, who can constitute a directing mind and will, and the principles governing attribution, including special rules of attribution. It also considers the evidence required to establish attribution and corporate liability, the position where the directing mind is absent from trial, and conspiracy between a corporate body and its directing mind. What is the identification principle? The identification principle is the means by which a company can be prosecuted for offences which require a mental element, rather than merely for strict liability offences. Under the identification principle, criminal culpability derives from a company officer, who is considered to be ‘the directing mind and will’ (DMW) of the company, and whose actions are the actions of the company and whose mental state (knowledge, dishonesty, intention, recklessness or negligence) is attributed to the company. Company officers who are deemed to be the DMW or controlling mind of

1 Initial assessment 1 Guidance Under section 250 of the Crime and Policing Act 2026 (CPA 2026), an organisation may commit an offence where a senior manager, acting within the actual or apparent scope of their authority, commits that offence. Actual or suspected criminal conduct involving an individual who may qualify as a senior manager should be treated as a potential corporate criminal liability incident until an initial assessment has been completed. The purpose of the initial assessment is to establish the nature of the concern, determine whether immediate action is required to protect the organisation and preserve evidence, and ensure that the matter is escalated to the appropriate individuals. The organisation should avoid reaching conclusions about whether an offence has been committed or whether corporate criminal liability arises at this stage. 2 Actions Obtain and record the available information about the actual or suspected criminal conduct, including the relevant dates, individuals involved, suspected offence or conduct, affected business unit or legal entity, and any immediate risks to people, customers, assets or evidence. Identify the individual’s role, reporting line and principal responsibilities. Where it is

1 Introduction 1.1 We have conducted an organisation-wide assessment of the risks of corporate criminal liability. We have done this through engagement with key stakeholders, including senior personnel within the organisation. There is significant overlap with risks we have previously identified through existing compliance, governance and risk management processes, including[ anti-money laundering (AML), counter-terrorist financing (CTF) and counter-proliferation financing,] anti-bribery and corruption, tax evasion facilitation prevention, fraud risk management, sanctions compliance, health and safety, data protection and other regulatory compliance assessments. We have also considered wider corporate criminal liability risks through this process. 1.2 This document records the risks we have assessed, the conclusions reached, and details of action points we consider necessary as a result of this assessment. 1.3 Our review included consideration of: 1.3.1 who may qualify as a ‘senior manager’ and the scope of their actual and apparent authority; 1.3.2 our governance arrangements, including decision-making authority, oversight and delegation arrangements; 1.3.3 existing compliance assessments, monitoring records and other sources of information relevant to corporate criminal liability risks; 1.3.4 [our international operations;] 1.3.5 our information flow, reporting and escalation procedures. 2 Overview of the organisation Size and nature of the organisation [Insert

This corporate criminal liability risk management plan records the steps we have taken in planning and implementing appropriate measures to manage corporate criminal liability risks in [insert organisation name]. It covers the following key areas: —risk assessment; —risk-based measures; —top-level commitment; —due diligence; —communication and training; —incident response and investigations; and —monitoring and review. 1 Risk assessment Conduct a risk assessment. Action Comment □ Identify senior managers and both the actual and apparent scope of their authority. [Insert any comments you may have in relation to this action point] □ Review governance processes. [Insert any comments you may have in relation to this action point] □ Assess corporate criminal liability risks arising from the organisation's activities, eg financial crime, health and safety, environmental, data protection, employment, consumer and sector-specific regulatory risks where relevant. [Insert any comments you may have in relation to this action point] □ Assess day-to-day operational risk considerations, eg around senior management recruitment. [Insert any comments you may have in relation to this action point] □ Review existing sources of information relevant to corporate criminal liability risks, eg governance records, disciplinary records, whistleblowing reports, training records, monitoring records, audit findings

This Practice Note explains how corporate criminal liability can arise via statutory senior manager attribution under section 250 of the Crime and Policing Act 2026 (CPA 2026). It considers when criminal liability may be attributed to a body corporate or partnership through the acts of a senior manager acting within the actual or apparent scope of their authority, the meaning of ‘senior manager’, the organisations within scope, and how the attribution route interacts with other forms of corporate criminal liability. It also considers enforcement, investigations and practical risk management considerations. What is the senior manager attribution route to corporate criminal liability? Senior manager attribution is a statutory mechanism through which criminal liability may be attributed to an organisation where a senior manager commits an offence while acting within the actual or apparent scope of their authority. The regime was first put on a statutory footing through sections 196 and Schedule 12 to the Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023) in relation to specified economic offences. On 29 June 2026, CPA 2026, s 250 expanded

This Precedent is designed to help you identify and assess individuals who may fall within the definition of senior manager for corporate criminal liability purposes and record the scope of their authority. It is designed to be used alongside Precedents: • Corporate criminal liability—decision-making authority map • Corporate criminal liability—risk assessment • Corporate criminal liability—risk management plan Senior manager attribution under section 250 of the Crime and Policing Act 2026 (CPA 2026) means that an organisation may be criminally liable where a senior manager commits an offence while acting within the actual or apparent scope of their authority. A senior manager is an individual who plays a significant role in: • making decisions about how the whole or a substantial part of the activities of the organisation are to be managed or organised; or • managing or organising the whole or a substantial part of those activities. Identifying

This Practice Note explains the principle of vicarious liability in criminal law. It covers vicarious liability for public nuisance, vicarious liability expressed by statute such as the failure to prevent offences, vicarious liability implied by statute, including the meaning of use, sell and possess, and vicarious liability and offences involving a mental element. It deals with the meaning of effective delegation, mental element offences, when would a delegate act outside their authority and the position regarding vicarious liability, and offences involving strict liability. What is vicarious liability? The general principle in criminal law is liability is personal not vicarious. This means that one person cannot be held liable for the crimes of another (other than where a person has aided, abetted, counselled or procured the act of another) (see R v Huggins). See Practice Note: Encouraging and assisting criminality. There are exceptions to this general principle and, in some circumstances, liability can be transferred vicariously to another. Vicarious liability for public nuisance In R v Shorrock, the defendant was held to be vicariously

A corporate entity may serve as a director of another company, although all companies must have at least one director who is a natural person (CA 2006, s 155).

Sarah Hawes and Isobel Hoyle of Herbert Smith Freehills have produced two videos to provide practical insight into the most impactful developments in corporate law in 2023 and those coming up in 2024.

This is the principle of shareholders taking more than just a simple financial interest in their shareholdings.

This Practice Note focuses on the corporate governance regime applicable to a public company incorporated in the UK with shares admitted to trading on AIM, including the disclosure requirements on corporate governance information in Rule 26 of the AIM Rules for Companies. It provides an overview of the QCA corporate governance code as well as guidelines published by certain institutional investor bodies. The corporate governance framework The principal framework for corporate governance in the UK for listed companies is the UK Corporate Governance Code (UKCG Code). Under the UK Listing Rules (UKLR), the UKCG Code applies to both UK and overseas companies with a listing of equity shares in the equity shares (commercial companies) listing category or the closed-ended investment funds listing category. A company with securities admitted to trading on AIM (AIM company) is not required to apply the UKCG Code although it may choose to do so. For further information on the UKCG Code, see Practice Note: The UK Corporate Governance Code. The principal rules and guidance relevant to the corporate governance