Key Takeaways
- • Since June 29, 2026, UK firms can be convicted of a criminal offense committed by a senior manager within the scope of their authority, under section 250 of the Crime and Policing Act 2026 (CPA), according to Dechert.
- • The universal senior manager attribution test covers the full range of UK criminal law, including fraud, data protection, financial sanctions and market misconduct, with no adequate-procedures defense.
- • For most newly in-scope offenses there is no deferred prosecution agreement pathway, so cases go straight to trial with conviction or acquittal as the only outcomes.
- • Private credit managers are immediately exposed because the senior manager definition is functional and can capture offshore GPs whose senior managers act from London or make UK-connected credit decisions.
- • Dechert advises firms to run risk assessments, map senior managers by actual decision-making responsibility across fund structures, and build joined-up responses to parallel FCA, ICO and CMA enforcement.
Summary
According to Dechert, the UK's new criminal attribution regime has been in force since June 29, 2026. Section 250 of the Crime and Policing Act 2026 introduced a universal senior manager attribution test under which an organization commits any criminal offense that one of its senior managers commits within the scope of their authority. Dechert notes that the regime is already live and that firms which have not acted are operating without the appropriate protections.
The regime is not confined to economic crime and spans fraud, data protection, financial sanctions, market misconduct and other areas of UK criminal law. Unlike the "failure to prevent" offenses under the Bribery Act 2010 or the Economic Crime and Corporate Transparency Act 2023, it offers no defense of adequate or reasonable procedures. For most newly in-scope offenses, no deferred prosecution agreement pathway exists, so attribution leads directly to trial rather than a negotiated resolution.
Dechert argues that private credit managers face immediate exposure. The senior manager definition is functional, capturing heads of origination, portfolio management, credit, compliance, risk and finance regardless of board membership. The test also reaches offshore vehicles: a Luxembourg or Cayman GP whose senior managers run borrower due diligence from London or approve UK-connected credit decisions may be caught. The only carve-out applies where all relevant conduct occurred outside the UK and the organization would not itself have committed the offense.
Parallel enforcement compounds the risk. Criminal prosecution may run alongside action by the Financial Conduct Authority, the Information Commissioner's Office or the Competition and Markets Authority. Dechert highlights the operational complexity this creates, including coordinating legal privilege across proceedings, disclosure to one authority being compellable by another, and regulatory settlement rarely resolving the criminal track. The firm recommends a joined-up response framework from the outset.
Dechert's practical guidance is that firms should run risk assessments across the offenses most relevant to their activities, map senior managers by actual decision-making responsibility across fund structures, and establish clear escalation protocols. As an illustration, the article describes a head of credit who knowingly obtained personal data from a borrower's systems without consent during a workout, which could expose the firm to strict criminal liability under the Data Protection Act 2018 without any institutional failing.
The regime is not confined to economic crime and spans fraud, data protection, financial sanctions, market misconduct and other areas of UK criminal law. Unlike the "failure to prevent" offenses under the Bribery Act 2010 or the Economic Crime and Corporate Transparency Act 2023, it offers no defense of adequate or reasonable procedures. For most newly in-scope offenses, no deferred prosecution agreement pathway exists, so attribution leads directly to trial rather than a negotiated resolution.
Dechert argues that private credit managers face immediate exposure. The senior manager definition is functional, capturing heads of origination, portfolio management, credit, compliance, risk and finance regardless of board membership. The test also reaches offshore vehicles: a Luxembourg or Cayman GP whose senior managers run borrower due diligence from London or approve UK-connected credit decisions may be caught. The only carve-out applies where all relevant conduct occurred outside the UK and the organization would not itself have committed the offense.
Parallel enforcement compounds the risk. Criminal prosecution may run alongside action by the Financial Conduct Authority, the Information Commissioner's Office or the Competition and Markets Authority. Dechert highlights the operational complexity this creates, including coordinating legal privilege across proceedings, disclosure to one authority being compellable by another, and regulatory settlement rarely resolving the criminal track. The firm recommends a joined-up response framework from the outset.
Dechert's practical guidance is that firms should run risk assessments across the offenses most relevant to their activities, map senior managers by actual decision-making responsibility across fund structures, and establish clear escalation protocols. As an illustration, the article describes a head of credit who knowingly obtained personal data from a borrower's systems without consent during a workout, which could expose the firm to strict criminal liability under the Data Protection Act 2018 without any institutional failing.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.