Corporate and vicarious criminal liability

Corporate criminal liability extends criminal law beyond natural persons to companies through the identification doctrine: a company is criminally liable only for acts and mental states of those constituting its 'directing mind and will' — typically directors and senior managers, not ordinary employees (Tesco Supermarkets Ltd v Nattrass [1972] AC 153). This narrow doctrine treats senior officers as embodiments of the company itself rather than mere agents. Post-2007 statutory reforms have created alternative liability regimes: the Corporate Manslaughter and Corporate Homicide Act 2007 uses a broader 'senior management' test, while the Bribery Act 2010 s 7 and Criminal Finances Act 2017 ss 45-46 impose strict liability for failing to prevent specified offences, subject to due diligence defences. The rationale reflects the conceptual difficulty of attributing mens rea to artificial legal persons while recognising that the orthodox doctrine often immunises large corporations from prosecution for systemic failures.

Tesco Supermarkets Ltd v Nattrass [1972] AC 153: Established the orthodox identification doctrine — only those who embody the company's 'directing mind and will' can render it criminally liable, not branch managers or ordinary employees. This remains the default rule for mens rea offences outside specific statutory regimes.

Meridian Global Funds Management Asia Ltd v Securities Commission [1995] 2 AC 500: The Privy Council qualified the strict identification doctrine — attribution rules may be derived from statutory policy rather than the orthodox test. This opened possibilities for broader corporate liability in regulatory contexts.

Cotswold Geotechnical Holdings Ltd [2011] EWCA Crim 1337: First conviction under the Corporate Manslaughter and Corporate Homicide Act 2007, where sole director's failure to maintain safe conditions caused employee's death. Demonstrated the senior management test could catch small companies but did not test application to large corporations.

Serious Fraud Office v Standard Bank Plc (DPA, November 2015): First deferred prosecution agreement under Bribery Act 2010 s 7 failure-to-prevent regime. Established DPAs as procedural alternative to full prosecution, with companies admitting wrongdoing and paying penalties without contested trial.

R (KBR Inc) v Director of the Serious Fraud Office [2021] UKSC 2: Supreme Court held SFO could not compel production of documents held abroad by foreign parent company. Clarified territorial limits on UK corporate criminal liability's international reach.

Courts first determine which liability regime applies: the identification doctrine for general mens rea offences, the senior management test for corporate manslaughter under the 2007 Act, or strict liability for failure-to-prevent offences under the 2010/2017 Acts. For identification doctrine cases, courts ask whether the individual whose acts/mental state are in question constitutes the company's directing mind — typically board directors and very senior managers with strategic control. For corporate manslaughter, courts assess whether senior management's role in organising activities was a substantial element in the gross breach causing death. For failure-to-prevent offences, liability is automatic once an associated person commits the predicate offence intending to benefit the company; the company must then prove it had adequate procedures to prevent such conduct. Common factual triggers include workplace deaths (engaging 2007 Act), bribery by employees or agents (engaging 2010 Act s 7), and facilitation of tax evasion (engaging 2017 Act). Deferred prosecution agreements now provide a procedural alternative for resolving corporate cases without trial.

Students wrongly assume the identification doctrine is obsolete — it remains the default for mens rea offences outside specific statutory regimes. Many confuse the senior management test (2007 Act) with the directing mind test (Tesco) — they differ in scope but each applies within its framework. Students often treat failure-to-prevent liability as universal when it applies only to bribery, tax evasion, and (post-2023) fraud. Missing the Meridian qualification is common — the identification doctrine can be modified in regulatory contexts where statute supports broader attribution. Finally, students overlook the practical importance of DPAs in shaping how corporate liability is actually enforced.