UK CPA Section 250: Penalties and Enforcement

By Kevin M. Hyams 

Section 250 of the UK Crime and Policing Act 2026 broadens the route by which criminal conduct may be attributed to a body corporate or partnership. For busy boards, compliance teams and advisers, the practical question is not simply whether section 250 applies. It is what the organisation could face, what should be assessed now, and what evidence supports the conclusions reached. This article explains the potential penalties and enforcement route in plain English and sets out the principal matters an organisation may need to assess and evidence.

Why I wrote this article

In more than 35 years of governance, risk and compliance work, I have repeatedly seen a simple legal statement create a much less simple assessment task. Section 250 is a good example. It is easy to say that an organisation may also commit an offence committed by a senior manager. It is harder to map the relevant people, authority, offences, penalties, controls and evidence without creating an unnecessarily heavy project.

This article explains the position in plain English and concentrates on what a time-conscious board, compliance team or adviser needs to understand and assess.

What does section 250 do?

Section 250 is a corporate attribution rule. It provides that, where a senior manager of a body corporate or partnership commits an offence while acting within the actual or apparent scope of their authority, the organisation also commits that offence, subject to the territorial limitation in subsection 250(2). The provision has been in force since 29 June 2026.

The definition of senior manager is based on function, not title. It covers an individual who plays a significant role in deciding how the whole or a substantial part of the organisation’s activities are managed or organised, or in actually managing or organising those activities.

The assessment must therefore examine what people do in practice, including the authority they hold or appear to hold. An organisational chart or job title alone may not provide a reliable answer.

Who and what may be in scope?

The rule can apply to bodies corporate and partnerships, including certain organisations formed outside the United Kingdom. The main attribution questions are:

• Was the individual a senior manager under the functional definition?
• Did that individual commit the underlying offence?
• Were they acting within the actual or apparent scope of their authority?
• Does the territorial limitation prevent attribution to the organisation?

The territorial limitation matters. Attribution does not arise under section 250 if all conduct constituting the offence occurs outside the United Kingdom and the organisation would not commit the offence if the conduct were its own. Territorial questions should be assessed against the actual facts and the law governing the underlying offence.

What penalties could an organisation face?

There is no universal “section 250 fine”. The organisation commits the underlying offence, so the available sentence and financial orders must be identified from the legislation and sentencing framework for that offence.

Criminal fines

A fine is likely to be the principal criminal sentence for an organisation, but the amount cannot be stated generically. Some offences allow an unlimited fine; others set a maximum. Where a sentencing guideline applies, the court may consider factors such as culpability, harm, financial circumstances, aggravating and mitigating features, and proportionality.

Compensation, confiscation and costs

Additional financial exposure may arise where the applicable law and facts permit it. A court may consider compensation for injury, loss or damage. Confiscation may also be considered under proceeds-of-crime legislation. A confiscation order is distinct from a fine and, in England and Wales, may only be made by the Crown Court. Prosecution costs and other financial orders may also be available.

Offence-specific and business consequences

Some offences allow additional orders or lead to regulatory consequences affecting licences, permissions, remediation, procurement or regulated activities. Investigation or conviction may also bring management time, legal and investigation costs, customer concern, insurance issues and scrutiny from lenders or investors. These are not automatic penalties under section 250, but they may be relevant to the organisation’s risk assessment and response planning.

How may section 250 be enforced?

Section 250 does not create a dedicated regulator or a single enforcement process. The route depends on the alleged underlying offence and the relevant UK jurisdiction.

1. An alleged offence is identified or reported.
2. The relevant police force, regulator or specialist body investigates and gathers evidence.
3. The evidence is considered against the underlying offence and the section 250 attribution conditions.
4. The legally authorised prosecutor decides whether to bring proceedings under the applicable tests.
5. If convicted, the organisation is sentenced under the law and guidance applying to the underlying offence.

The powers, evidential rules and prosecution tests vary. Organisations should obtain offence-specific legal advice rather than assume that every section 250 matter will follow the same path.

Is there a general compliance defence?

No general adequate-procedures or reasonable-procedures defence appears in section 250 itself. That is different from legislation that creates a specific failure-to-prevent offence with an express, procedures-based defence.

Policies, controls, training and monitoring still matter. They may help prevent or detect offending and may be relevant to evidence, remediation, regulatory response and sentencing. They should not, however, be described as a universal statutory defence to section 250.

What should an organisation assess now?

A proportionate assessment should connect legal scope to operational reality. The priority areas are:

• Scope: identify relevant bodies corporate, partnerships, activities, locations and territorial issues.
• Senior managers: map people who may meet the functional definition, rather than relying only on titles.
• Authority: record formal delegations and consider apparent authority created by actual practice.
• Offence exposure: identify material offence categories relevant to the organisation’s activities.
• Consequences: map potential corporate penalties, additional orders and enforcement routes by offence.
• Controls: assess prevention, detection, escalation, investigation and evidence-preservation arrangements.
• Evidence: link each conclusion to current documents, records and reviewable workpapers.
• Remediation: record gaps, ownership, priorities, target dates and residual risk.

For partnerships, proceedings under section 250 must be brought in the partnership’s name, not in the names of individual partners. A fine imposed on the partnership is payable from partnership assets. Separate liability of individuals depends on the underlying offence and other applicable law.

What evidence may support the assessment?

Evidence should show not only what the organisation says its arrangements are, but how they operate. Relevant examples may include:

• role descriptions, organisation charts and senior manager mapping;
• delegated authority matrices, committee terms and approval records;
• offence-risk assessments, compliance monitoring and legal reviews;
• training, escalation, speak-up and investigation records;
• board and committee papers, minutes and management reports;
• evidence-preservation, legal hold and remediation records.

The list is illustrative. The appropriate evidence will depend on the organisation, the offence exposure and the conclusion being supported. The key discipline is traceability: a reviewer should be able to understand what was assessed, why the conclusion was reached, and which evidence supports it.

How NORVA supports a structured assessment

The practical challenge sits in the “Missing Middle”. A short legal note or ad hoc spreadsheet may not connect senior manager roles, authority, offence exposure, penalties, controls, evidence and actions. A major enterprise implementation may be disproportionate to the work required.

NORVA’s Excel-native smart templates provide a structured route through the assessment using a familiar environment. Depending on the template, teams can:

• work through sequenced assessment questions and practical assessor guidance;
• record scope, maturity, gaps, risks, controls and remediation;
• link conclusions to supporting evidence and source materials;
• generate dashboards, status reporting and review-ready outputs from the assessment.

The aim is not to replace legal advice or determine criminal liability. It is to make the assessment easier to start, evidence, and report, without implementing a heavy enterprise platform. This supports both in-house teams and advisers who need a practical, repeatable and affordable approach.

Summary

• Section 250 attributes an underlying offence to an organisation when its statutory conditions are met.
• There is no fixed section 250 penalty; consequences depend on the underlying offence and jurisdiction.
• Senior manager status and actual or apparent authority must be assessed on the facts.
• A general procedures-based defence is not stated in section 250 itself.
• A defensible assessment should connect scope, offence exposure, controls, evidence, risk and remediation.
• NORVA helps teams structure and report that work in a familiar Excel-native environment.

Conclusion

Section 250 changes the route by which senior manager conduct may create criminal liability for a body corporate or partnership. The responsible response is not to guess at one headline fine or create a stand-alone section 250 policy. Instead, identify the senior managers and authority arrangements that matter, map the relevant underlying offences and consequences, assess the controls relied upon, and link every material conclusion to evidence.

That work need not become unnecessarily complicated. A structured, proportionate assessment can give boards, management and advisers a clear view of exposure, gaps and next actions. NORVA is designed to support that discipline with an accessible, affordable, Excel-native approach.

Explore the NORVA Compliance Assessment Toolkit

See how NORVA turns regulatory, risk and governance requirements into structured, evidence-based assessments using familiar Excel-native smart templates.

Source and legal review note

This article provides practical information on compliance assessment. It is not legal advice, does not determine criminal liability and should not replace offence-specific legal review. Organisations should obtain advice from appropriately qualified legal advisers where interpretation, territorial scope, senior manager status, privilege, prosecution risk, penalties, confiscation, regulatory consequences or defence strategy requires legal judgement.

Primary sources and further reading

Crime and Policing Act 2026, section 250: https://www.legislation.gov.uk/ukpga/2026/20/section/250

Crime and Policing Act 2026, section 255 commencement: https://www.legislation.gov.uk/ukpga/2026/20/section/255

Sentencing Council, corporate offenders: fraud, bribery and money laundering: https://sentencingcouncil.org.uk/guidelines/corporate-offenders-fraud-bribery-and-money-laundering/

Sentencing Council, confiscation order overview: https://sentencingcouncil.org.uk/ancillary-suppl-information-text/confiscation-order/