The Crime & Policing Act 2026 (CPA) introduces a significant expansion of corporate criminal liability for businesses operating in the UK. Building on reforms introduced by the Economic Crime and Corporate Transparency Act 2023 (ECCTA), the CPA extends the circumstances in which criminal conduct by a senior manager can be attributed to the company itself.
While the CPA is primarily focused on increasing the liability of organisations, rather than expanding the duties of senior managers, it continues a broader trend towards greater accountability and scrutiny of corporate decision-making. As a result, businesses should consider how the CPA’s introduction could affect both their governance and D&O insurance programme.
What changes has the CPA introduced?
The CPA, like the ECCTA, focuses on “senior managers”, who are not defined by title, but instead as individuals who play a significant role in how the organisation's operations are managed, increasing the scope of conduct that could transpose to the company.
Under ECCTA, organisations could be held criminally liable where a senior manager committed certain economic crimes while acting within the actual or apparent scope of their authority. The CPA extends this principle by applying it to all criminal offences – significantly broadening the potential exposure for companies.
What does this mean for boards and senior management?
The CPA does not create new duties for directors or senior managers.
Instead, it increases the potential liability of the organisation for offences committed by those individuals acting within their authority.
Accordingly, we expect organisations to experience:
Greater attention from regulators and prosecutors on the actions and decision-making of senior managers.
Increased scrutiny of senior managers in investigations related to alleged corporate wrongdoing – in order to attribute liability to the organisation, individual culpability must first be established.
More requests for directors to provide information or act as witnesses during investigations.
Follow-on civil action, in the event guilt is found.
Increased scrutiny of board oversight and whether directors exercised appropriate care, skill, and diligence in seeking to prevent criminal conduct.
Additional focus on corporate governance, in particular how companies are adapting their internal controls and compliance frameworks.
All of the above may lead to more claims under D&O policies, although the jury is out on this at present and the impact of the CPA will only become clear with time. The legislation may also encourage organisations to self-report potential offences to help demonstrate cooperation with enforcement authorities.
How does a D&O policy respond?
D&O insurance is designed to protect directors, officers, and other insured persons against losses arising from claims alleging wrongful acts, including regulatory investigations involving insured individuals. It also provides balance sheet protection where a company indemnifies an insured individual for a covered loss. Whilst the scope of an “Insured Person” varies between policies, it is possible to obtain cover for employees acting in a managerial or supervisory capacity, encompassing the scope of a Senior Manager as defined by the act.
However, D&O policies do not generally cover claims or investigations brought directly against the company itself. As the CPA primarily increases corporate liability, much of the additional exposure created by the legislation sits outside the scope of traditional D&O cover.
For insured individuals, defence costs are likely to be the primary source of cover in relation to CPA-related investigations. While D&O policies contain conduct exclusions for fraud and dishonesty, appropriate carvebacks should mean that insurers treat insured persons as innocent until proven guilty. Furthermore, insurers will often advance defence costs while investigations or proceedings are ongoing, although they retain the right to seek repayment where excluded conduct is ultimately established.
Insurance solutions for the increased exposure of a business remain limited. While private companies are able to purchase Corporate Legal Liability extensions, these may exclude or sub-limit cover for investigations or proceedings brought by official bodies. Recognising the increased exposure this change creates for both the company and individuals, we are partnering closely with insurers willing to provide extensions to cover to assist companies in transferring this evolving risk.
Looking ahead
The CPA reinforces efforts to increase both corporate accountability and scrutiny of senior management decision-making.
While the most significant impact of the legislation is the expansion of corporate liability, businesses should also expect increased focus on the actions of senior managers during investigations and enforcement activity. Organisations should continue to review their governance frameworks, compliance procedures, and D&O insurance arrangements to ensure they remain appropriate for the evolving regulatory landscape.
For further information on how the CPA may affect your organisation or for a confidential review of how your existing D&O policy may respond, please contact a member of our Management Liability Team.
