1. The ECCTA 2023 in theoretical context

Before embarking on detailed consideration of the points made in the introduction above, we should consider the roads not taken, and the path that led to the 2023 reforms. It is trite law that a company may be regarded as in an important sense a ‘myth and a fiction’,Footnote ¹⁹ a ‘legal abstraction’,Footnote ²⁰ ‘mere machinery’,Footnote ²¹ or ‘an abstract conception’.Footnote ²² As Lord Hoffmann put it, ‘There is in fact no such thing as the company as such, no ding and sich, only the applicable rules [of attribution]’.Footnote ²³ We can call this the conception of a company as a ‘formal legal’ entity. On the one hand, so to conceive of a company might suggest that a company is not a fit subject for criminal liability at all, lacking moral agency.Footnote ²⁴ On the other hand, to conceive of a company in such terms might superficially appear liberating, in criminal law terms. If a company is not a moral agent, then perhaps the constraints on criminalisation ordinarily applicable to moral agents – in particular, a bar on imposing vicarious liability for stigmatic (fault-based) crimes – do not apply? The latter line of thinking has been adopted in the US Federal law, where justifications for imposing criminal liability on companies have frequently been largely instrumental in character. For example, in affirming that a company could be held vicariously criminally liable for fault-based crime, in New York Central and Hudson River Railroad Company v US,Footnote ²⁵ Justice Day said:

Some English criminal law theorists have advocated that English law take a broadly similar approach. For example, GR Sullivan has argued in favour of a model of vicarious criminal liability for companies (albeit with a due diligence defence), in part on the grounds that, ‘[t]here is no conceptual basis for a retributivist response to corporate illegality and no basis … for the claim that corporations are substantive moral agents which may perpetrate specifically corporate wrongs’.Footnote ²⁷ Partial vindication of his approach might now seem to have come, in the form of a proliferation of failure-to-prevent offences such as those created by section 199 of the ECCTA 2023, although it is important to keep in mind that failure-to-prevent offences are offences in their own right, and not instances of vicarious liability, even though liability is triggered by the occurrence of the predicate offence.Footnote ²⁸

However, English law has traditionally been slower to throw off the side-constraints on criminalisation traditionally imposed by morality, simply because it is a company that is on trial. In Tesco Supermarkets v Nattrass,Footnote ²⁹ Lord Morris remarked:

In a way, thus, the identification doctrine can be considered to be the product of an argument for traditional constraints on (corporate) criminalisation that is a moral argument ‘by proxy’. Company directors are moral agents and so, if a company’s acts are identified with the acts of such persons, then the same (moral) constraints on criminalisation will apply to the company as apply to its directors.

Even so, this justificatory path to the moralisation of corporate criminal liability has in-built limitations. As I will argue in section 3 below, one reason that only the acts of company directors have traditionally been regarded as identified with the company is that only directors have supreme executive authority under a company’s constitution.Footnote ³¹ The criminal law’s moralised understanding of the company, as a formal legal entity, is thus allied to a conception of it as what might be called an entity led by a ‘supreme authority’, a conception derived from the constitutional building blocks of a company set down in the Companies Act 2006. This is an entity wherein supreme executive authority rests with one or more persons (the directors), whose ultimate responsibility it is to account to the outside world (including regulatory and prosecutorial authorities) for the company’s conduct.Footnote ³² It follows that if, as now happens in virtue of section 196 of the ECCTA 2023, a company’s acts may be identified with non-director ‘senior managers’, then the moral argument ‘by proxy’ for corporate criminal liability is weakened. That is because it has become detached from the conception of the company as an entity led by a supreme authority. Senior managers may be moral agents, but they are – just like any other employee – answerable for their conduct, qua managers, to a higher authority within and not external to the company. So, in being fixed with liability for the crimes of senior managers, companies, as entities led by a supreme authority, are being made vicariously liable for the actions of their employee senior managers: an outcome a moralised account of corporate wrongdoing is meant to avoid.

The extension of a company’s identity to include ‘senior managers’ has been endorsed by Celia Wells, whose path-breaking work has done much to shape the course of scholarly argument, and ultimately legal reform.Footnote ³³ However, in common with a number of other scholars, her main focus has been a quite different way of seeking to ‘moralise’ the company, for the purpose of justifying criminalisation. A number of scholars have sought to do this by changing the understanding of a company underpinning the moralisation. Instead of relying on a Weberian, bureaucratic conception of a company as a ‘formal legal’ entity or an entity with a ‘supreme authority’, influential academic theorising (and some examples of criminal law creation under statute) has sought to construct a moralised system of corporate criminal responsibility by reference to companies as so-called ‘real’ entities.Footnote ³⁴ Company law theorist Eva Micheler explains the idea of a company as a ‘real entity’ thus:

On this view, companies are much more than just formal legal entities. Instead, they are characterised by their ‘real’ lives: their routines, procedures, and culture. As Wells put it, ‘internal structure and culture affect a company’s actions’, and so, ‘an act is corporate not only because of its form, but because of the policy it instantiates, displays or manifests’.Footnote ³⁶ Section 12 of the Australian Criminal Code Act 1995 sought to give legislative expression to this idea. Under section 12, a company will be found to have culpably (intentionally or recklessly) committed an offence if it authorised or permitted its commission; and the company may be found to have authorised or permitted the commission of an offence if, amongst other things, ‘a corporate culture existed within the body corporate that directed, encouraged, tolerated or led to the non-compliance with the relevant provision’.Footnote ³⁷ More recently, in a similar vein, Elise Bant has argued that it is possible to infer corporate intention to offend, and not merely reckless or negligence toleration of offending, in the operation of systems and processes that lead employees to engage in wrongdoing.Footnote ³⁸

A key feature of many of these accounts (Celia Wells’ account is an exceptionFootnote ³⁹) of the moralised basis of corporate criminal responsibility is that they focus on aspects of a company as a real entity that point solely to inculpation, rather than to exculpation. In other words, dysfunctional or corrupted aspects of a firm’s procedures, processes and culture, that explain why an act of wrongdoing occurred, are taken as evidence of culpable corporate states of mind such as intention or recklessness in relation to the commission of that wrongdoing. In making such arguments, adherents of real entity theories of corporate culpability fail to convince. To begin with, what if the dysfunctional or corrupted aspects of procedures, processes or culture were, even if they shed light on the offending, very much a minority, ‘counter-cultural’ presence in a firm that was otherwise one that adhered to high standards? If liability is still imposed on the firm in such circumstances, it is unclear how this meets the demand that criminal liability must involve so-called ‘fair labelling’: the demand that an offence properly represent the involvement of the person convicted.Footnote ⁴⁰ For that reason, Wells suggests that a firm ought to be able to resist liability, in such circumstances, if it can show that the offending was ‘against established internal policy’;Footnote ⁴¹ but that point takes us back to the question of (supreme) authority: ‘established’ at what level within the firm?

In its paper that formed the basis for the ECCTA 2023 reforms, the Law Commission rejected a ‘real entity’ basis for inculpation,Footnote ⁴² and this rejection reflects a more fundamental difficulty with such a basis for inculpation. The existence of a system, procedure, process or culture is an ongoing ‘state of affairs’ (be it good or bad), and is as such acausal in nature. It has no status or identity as a unique act or omission taking place at a moment in space-time. Yet, many serious crimes, such as fraud or bribery, require proof of their manifestation as an ‘act-token’, a causally significant, unique space-time particular. The existence of a given system, procedure, process or culture within a company qua real entity cannot be, then, constitutive of an act in space-time associated with it (such as fraud), even though that procedure, process or proof may very well explain why such an act came to be engaged in. By contrast, evidence of a ‘state of affairs’ constituted by (sound) procedures, processes and culture can be potent exculpatory evidence,Footnote ⁴³ a point reflected in the Government’s formal guidance on the exculpatory defence – to the offence of failing to prevent fraud – of ‘reasonable (fraud prevention) procedures’.Footnote ⁴⁴ That is because evidence of such a state of affairs is evidence that certain ‘types’ of action – bribery; fraud; dangerous conduct – have been made by management to seem unacceptable to (most) company employees, or at least significantly harder to commit undetected. When management has achieved this state of affairs, then making it a legal ground for exculpation provides an incentive for other firms to do likewise, rather than expending their efforts instead on covering up offending, or seeking to put all the blame on the individual offending employee. As we will see, an anomaly in the ECCTA 2023 reforms is that they follow through on this point with a reasonable prevention procedures defence in relation to the section 199 offence of failing to prevent fraud and related offences, but not in relation to extended liability under section 196.

2. Extended corporate criminal liability under the ECCTA 2023

Section 196(1) of the ECCTA 2023 provides that:

In relation to the concept of a ‘senior manager, ‘section 196(4)(c) provides that:

These reforms stem from a recent examination of the issues by the Law Commission, in the course of which the Commission set out the ‘senior manager’ provisions as one of a series of options for reforming the traditional basis for attributing fault-based crimes to companies.Footnote ⁴⁵

As we have seen, prior to the ECCTA 2023, only persons with ‘directing mind and will’ status (company directors) were persons whose words and actions were identified with the company and hence were regarded as the words and actions of the company itself;Footnote ⁴⁶ and the common law insisted that, with fault-based crimes, the prosecution show that all the elements of the offence (be they culpable words or actions) were identified with the company in this sense. So, for example, in order for a company to be convicted of fraud, contrary to section 2 of the Fraud Act 2006 (a fault-based crime), the traditional version of the identification doctrine required any false representation dishonestly made to have been made by someone at directorial level, acting within the scope of their authority.Footnote ⁴⁷ The making of such a false representation by any other person in the company, no matter how high-ranking, would not – unless someone with directing mind and will was complicit in its making – implicate the company itself. Once the identification doctrine became authoritative at common law, older cases in which a fraud perpetrated by a senior manager (below board level) in the course of their employment was attributed to the company, were no longer regarded as sound in law.Footnote ⁴⁸ Accordingly, section 196 will, in all probability, have the effect of producing a different outcome in cases with facts such as those in the well-known case of R v Andrews Wetherfoil. Footnote ⁴⁹

In that case, a company’s managing director, a ‘technical’ director and the manager of a housing division had been involved in corrupt contractual dealings. The question was whether that meant their company was also guilty of corruption. The Court of Appeal quashed the company’s conviction, holding:

The outcome would in all probability now be different, in such a case, in that it is likely that the managing director, the technical director, and even the manager of the housing division, would all be regarded in law as ‘senior managers’, in accordance with the definition given above.

In broad fair labelling terms, you might think it plausible to suppose that if (say) a firm’s regional manager engages in fraud or corruption to benefit the company, the company itself should also be regarded as committing those crimes through the manager’s acts; but that conclusion may be doubted. Consider this possibility. It is trite law, both in the UK and the US, that an employee may still be regarded as acting within the scope of their employment (and to benefit the company) even if the action in question was contrary to company policy or to their superior’s orders.Footnote ⁵¹ So, suppose that a senior manager (such as one of those in Andrews Wetherfoil), acting within the scope of their authority, engages in corruption to win business for their company; but, the board of directors not only knew nothing of the manager’s intentions, but had also recently reaffirmed to all managers the company’s long-standing commitment to ‘zero tolerance’ of corruption in any form. In such circumstances, whether or not the senior manager is acting within the scope of their authority, is it really fair to label the company itself as guilty of corruption, in virtue of the manager’s actions? The common law’s former focus on directors, whatever its limitations (explored in due course), was designed to avoid this problem. As indicated above, that is because such a focus was meant to ensure that, in committing a crime, a director would not be betraying a higher authority within the company.Footnote ⁵² In Tesco v Nattrass, Viscount Dilhorne put it this way, in defining a senior officer (director) who could be identified with the company, by contrast with other people within it, such as employees, however high-ranking:

There is a further reason why it may be regarded as unfair to saddle a company with liability for the acts of (errant) senior managers. This is a reason that comes in part from a point alluded to at the start: the failure to align the aims of section 196 with the aims of failure-to-prevent offences.

Under section 7 of the Bribery Act 2010, a company may be found criminally liable for a failure to prevent bribery, if bribery is committed by someone associated with the company (whatever their status) in order to benefit the company. That, of course, is precisely what has happened in the hypothetical example given aboveFootnote ⁵⁴ (and indeed, in Andrews Wetherfoil). Suppose, then, that someone associated with a company,Footnote ⁵⁵ no matter what their status within the company, has committed bribery in order to benefit the company. It is in a way hard to imagine a more appropriate and fitting label for the company’s involvement than to say that it failed to prevent the bribery, especially in circumstances in which it had taken no steps (or only ineffectual steps) to prevent such a thing happening. However, as a result of section 196 of the ECCTA 2023, the clear picture in point of labelling provided by this legal position has become obscured. We now have to accept that, in a case where the person associated with the company who committed the bribery was someone the court rules to have been engaged in (for example) ‘managing a substantial part of [the company’s] activities’, the company itself is guilty of that self-same bribery. That is an unsatisfactory situation.

It is unsatisfactory for two main reasons. First, failure-to-prevent offences come with a complete defence that the company had in place at the relevant time adequate or reasonable crime-prevention procedures. No such defence applies to a company charged with an offence based on the application of section 196, even though the most senior people in the company may have been just as much in the dark about the commission of the offence by a subordinate senior manager in this instance, as when a failure-to-prevent offence applies.Footnote ⁵⁶ Section 196 thus creates a seemingly paradoxical situation. A company can be said to have been intentionally engaged in active corruption, fraud, or another fault-based crime (through the actions of a ‘senior manager’), at exactly the same time as, at the highest level, it earnestly and wholeheartedly disassociated itself from and disavowed such conduct. Section 196 thus creates a perverse incentive to cover up crime of all kinds committed by senior managers, so that the company will not be found to have committed the crimes itself, whilst (with the failure-to-prevent offences in mind) also enforcing procedures to prevent fraud or bribery being committed by lower-level employees.Footnote ⁵⁷ Secondly, the vagueness of the definition of ‘senior manager’ creates uncertainty concerning the scope of companies’ direct liability for substantive offences, undermining any claim that a company is fairly labelled as an offender in its own right when a senior manager acting within the scope of their authority commits the offence.

The Law Commission acknowledged, in relation to its consultation on the issue, that ‘the majority of respondents thought there was no merit in the Canadian and Australian identification principles which attribute corporate criminal liability when a member of the senior management has the requisite fault’.Footnote ⁵⁸ Nonetheless, the Law Commission concluded in relation to the definition of ‘senior manager’ that:

The difficulty with such speculation is how little concrete guidance it is capable of providing. In the example given, the chief editor-manager of each of two newspapers might, as the Law Commission suggests, be regarded as in charge of a ‘substantial part’ of the company’s affairs; but would the position really be so different if the company owned a string of local newspapers, each with its own editor-manager; and if so, why? In the case of each newspaper owned by the company, the editor-manager may (ex hypothesi) have essentially the same role.

The problem lies with the fact that the definition of ‘senior managers’ representing the company itself in section 196 goes beyond persons having what might be called ‘strategic policy’ responsibilities for the company or group of companies as a whole.Footnote ⁶⁰ In order to avoid a reform that might be perceived as merely tinkering at the edges of the old identification doctrine, ‘hands-on’ managers downstream (of a substantial part of a firm’s activities) are included. Such people are included, even though they may have no role whatsoever in setting the company’s overall strategy and policy, and may – depending on how the company operates – rightly see themselves largely as rule-followers, perhaps in a technical capacity, rather than primarily as rule-setters: think of someone employed to manage the running of a company’s IT. In that regard, the advantage of failure-to-prevent offences over the section 196 basis for liability is that, whatever the rank of the employee or agent associated with the company who committed the relevant crime, the company knows that it will face liability unless it had robust procedures in place to prevent such crimes. In that respect, there is an irony about section 196, given its intellectual and legislative origins. As indicated above,Footnote ⁶¹ the extension is based on corporate crime legislation in Canada, where – for example – corporate bribery of a foreign public official is committed if it is engaged in by a ‘senior officer’ of the company.Footnote ⁶² However, in its report on anti-bribery compliance in Canada, the OECD was critical of the effectiveness of the ‘senior manager’ version of the identification doctrine, when compared with the potential benefits of a failure-to-prevent offence.Footnote ⁶³ Although it is scheduled to be extended to all crimes in the UK,Footnote ⁶⁴ section 196 has mainly been introduced to cover, for most part, offences where it should be needed least: financial crimes to which the failure-to-prevent offences applies.Footnote ⁶⁵

3. Extended liability: some unresolved theoretical problems

The introduction of the reforms effected by section 196 provides an opportunity briefly to reflect on the philosophy that underpins them. In Lennard’s Carrying Co Ltd v Asiatic Petroleum Co Ltd,Footnote ⁶⁶ the case regarded as establishing the identification doctrine to govern corporate liability for fault-based offences, the company in question was a sole-director company. It is not hard to understand why, when the director of such a company engages in a criminal act of any kind, the company is ipso facto regarded as also engaging in that act. Even so, we should note the unclear theoretical basis for regarding even a sole director’s act as, in virtue of the director acting in a directorial capacity, the company’s ‘act’. The fact that such a director is an agent of the company establishes that the director’s acts will bind the company, but it does not establish that those acts are engaged in by the inanimate company itself. It seems more plausible to suppose that the so-called ‘identification’ doctrine is really just a way of severely limiting the circumstances in which a company will be held (vicariously) liable for a fault-based crime, for fair labelling reasons.Footnote ⁶⁷

Implicit in the identification doctrine is the view that, if a company is rightly to be found guilty of a stigmatic offence such as fraud, the demands of fair labelling dictate that the commission of that fraud should have been committed or authorised at the highest (directorial) level. In that regard, the focus on directors can be understood as having been guided not just by considerations of certainty, but also by the constitutional role, in corporate law terms, played by such persons. So far as the running – as opposed to ownership – of a company is concerned, the need to have directors is a corporate constitutional fundamental, in a way that the need (if any) for employees, however high ranking, is not.Footnote ⁶⁸ Directors have a special executive status granted to them by legislation. As we have seen, section 40 of the Companies Act 2006 says, ‘in favour of a person dealing with a company in good faith, the power of the directors to bind the company, or authorise others to do so, is deemed to be free of any limitation under the company’s constitution’.Footnote ⁶⁹ There is no such legislated constitutional basis for the powers exercised by employed senior managers.

Having said that, it is now clear that the common law’s focus on directors did not necessarily escape the fair labelling problem, discussed in section 2, which arises if a company’s board is betrayed when (contrary to instructions) a senior manager commits a fault-based crime. That is because neither in Lennard’s Case nor in Tesco v Nattrass was attention paid to the situation in which an individual director might be given a specific brief by the board in relation to, say, the striking of a deal, but might – whilst remaining with the scope of their directorial powers – betray the board by committing a crime in the course of striking the deal. As Davies LJ put it, in SFO v Barclays, ‘there is no general principle that the knowledge and approval of one director is necessarily and for all purposes to be regarded as the knowledge and approval of the board of directors (and thereby of the company)’.Footnote ⁷⁰ If that is true, then is there any longer a principled basis for refusing to extend a company’s liability in respect fault-based criminal acts beyond directors to include high level manager-employees? As explained in section 2, the answer to that question is that, in relation to all crimes (whether fault-based or not) committed by associated persons (whether directors, senior managers or employees), our focus should switch from the commission of the crime to the failure to prevent it. A company is fairly and appropriately labelled as having failed to prevent crime, when the failure is that of the board as a collective entity, however many directors it has and whatever their directorial status.Footnote ⁷¹ Understanding that such in-principle liability for a failure-to-prevent offenceFootnote ⁷² is based on a collective failure at the highest level, means that one eradicates the potential labelling problem involving in equating the acts of companies with the criminal acts of individual directors or senior managers.

Once one moves beyond the conduct of the one-person company, corporate crime is always relational in some sense. P, the perpetrator associated with the company, will be following or disobeying someone else’s instructions, or interpreting (probably wrongly) their remit in exercising a discretion conferred on them; and someone else or group of persons with oversight responsibilities will have failed to stop P committing the crime.Footnote ⁷³ It is the failure-to-prevent model, and not the identification doctrine, that makes a relational question central to the justification for conviction. The key question becomes: ‘granted that the board of directors has a responsibility – whether or not delegated – to prevent crime committed by associated persons, and (in a given instance) failed in that responsibility, should the company be held criminally liable for that failure?’ The failure-to-prevent model is sometimes thought of as an outlying species of corporate criminal offence, a poor substitute for ever more sophisticated doctrines of identification.Footnote ⁷⁴ On the contrary, one could just as easily think of ‘identification’ as the marginal case, a doctrine that works in an authentic way only in the case of the one or two-person company. On that view, the failure-to-prevent model could become the exemplar of the way in which companies themselves stand, in relation to crimes committed by all persons engaged on company business.Footnote ⁷⁵ For that reason, it is section 199 of the ECCTA 2023, that extends the reach of failure-to-prevent offences, that should have been the centrepiece of the reforms, with section 196 playing no part in the reforms at all.

4. Failure to prevent fraud: too small to fail?

The introduction of an offence of failure to prevent fraud, in section 199 of the ECCTA 2023, should be regarded as a major step towards providing, for the first time, a theoretically sound basis for corporate criminal responsibility for economic crime, and for fraud and related offences in particular. The background to the creation of this offence is that the National Crime Agency claims not only that there were 3.7 million incidents of fraud in England and Wales in the year ending December 2022, but also that 86% of fraud instances are unreported or underreported, and that £2.46 billion was lost by businesses and individuals alone to fraud in the financial year 2021/22.Footnote ⁷⁶ Section 199 of ECCTA 2023 now provides:

The most obvious point of comparison, in analysing this new offence, is its counterpart prohibiting corporate failure to prevent bribery: section 7 of the Bribery Act 2010.Footnote ⁷⁷ The most notable difference between the two offences, in that regard, is the restriction of the failure-to-prevent fraud offence to so-called ‘large organisations’, which under the ECCTA 2023 means organisations meeting two or more of the following criteria: a turnover of more than £36m, total assets of the more than £18m, and an average of more than 250 employees.Footnote ⁷⁸ By contrast, section 7 of the 2010 Act applies to all relevant commercial organisations irrespective of size. In the UK, 74% of UK businesses had no employees in 2022, and over 99% of businesses were small or medium-sized businesses (SMEs), employing 0–249 people.Footnote ⁷⁹ Of the 5.5 million businesses in the UK in 2022, only around 8,000 were large businesses – with 250 or more employees – representing just 0.1% of the business population, even though such businesses support 39% of jobs and nearly half of all business turnover.Footnote ⁸⁰ It follows that, in relation to many key investment decisions taken by families – such as buying a car, or renovating a house – the firms such families rely on to conduct transactions ethically will be outside the scope of this offence.

The Government rejected an invitation to confine the exemption from its scope to small companies, the small company threshold being 50 employees, £10.2 million of turnover and a £5.1 million balance sheet. In explaining this decision, Kevin Hollinrake MP said:

He also said, ‘The Government are extremely mindful of the pressures on companies of all sizes, including SMEs, and therefore do not feel it is appropriate to place this new unnecessary burden on over 450,000 businesses’.Footnote ⁸² It is understandable that the Government would wish to ensure that the burden of complying with what is (in fact, in not in law) a requirement to have reasonable procedures in place to prevent fraud does not outweigh the benefit of having the offence. The potential for encountering fraud, both offending and becoming a victim, is widespread throughout many sectors of the economy and by no means confined to larger firms. That provides a contrast with bribery, which is an offence that, for example, few plumbers, window cleaners, bakers or cab drivers will ever have to worry about. However, two criticisms should be made of the Government’s approach.

First, there is the general theoretical point made in the House of Lords that, if corporate failure to prevent fraud is (in the absence of reasonable procedures to prevent it) so wrong as to justify criminalisation, then that justification applies with equal force to all firms irrespective of size.Footnote ⁸³ The use of arbitrary line-drawing between firms, based on size, to determine which firms are in scope, is to confuse the permissible kinds of limits that can be placed on criminal law with factors relevant only to regulatory intervention. Secondly, even if an exemption for smaller firms could be justified, it needs to be justified in terms of sound economics and criminology. In that regard, it seems probable that the firms most likely to find that their employees have engaged in fraud to benefit the company will be firms seeking or undergoing economic growth.Footnote ⁸⁴ It follows, thus, that if there is a case for exempting a class of firms from the scope of the offence, it will be not all ‘small firms’ (those with eg fewer than 50 employees), since many such firms will be those striving for rapid growth and thus at greatest risk of encountering the use of fraud by their employees to achieve that end. Instead, the exempted class should be so-called ‘micro’ companies, with a turnover of £632,000 or less, £316,000 or less on their balance sheets, and 10 employees or fewer.Footnote ⁸⁵ That is because it is overwhelmingly likely that this class of firm – forming the majority of firms in the UK – will be run either as a ‘subsistence’ or as a ‘lifestyle’ small business,Footnote ⁸⁶ rather than for the purposes of economic growth. In other words, they will be run solely for the purpose of providing employment (and worthwhile activity) for an individual or family. Whilst such firms may well engage in tax fiddles, health and safety violations, and sector-specific regulatory infringements,Footnote ⁸⁷ they are unlikely to be involved in the commission of large-scale fraud of the kind the provisions of the ECCTA 2023 are meant to address.

One final point should be made about the scope of the section 199 offence. By virtue of section 199(7) and (8), it is brought into play when a fraud offence is committed by an employee, agent or subsidiary (or employee of a subsidiary), or by any other person providing services for the company. In that respect, a wider range of persons are to be regarded as ‘associated’ with a (large) company when they commit a predicate offence than is the case with other failure-to-prevent offences. Even so, there is a notable set of excluded cases, created by the requirement for the associated person committing the fraud offence to have acted with the intention (directly or indirectly) of benefiting the company itself or some other person for whom the associated person provides services for the company. Consider this example:

In this example, it is a long-standing principle of private law that C bank may be vicariously liable in damages to P, assuming that D was acting in the course of his employment.Footnote ⁸⁸ By contrast, however negligent it may have been, C bank will not be criminally liable for failing to prevent D’s fraud. That is because, in committing the fraud, D (ex hypothesi) did not act in order to benefit the bank or another person (including P) to whom D was legitimately providing services for the bank. The difference in outcome does more than illustrate a principle of parsimony at work in the imposition of criminal liability. It reveals a difference in the understanding of the ‘company’, for the purposes respectively of tort law and of failure-to-prevent offences in criminal law. Tort law regards companies as in essence a network of contracts,Footnote ⁸⁹ with the result that principles of liability centre on harmful wrongdoing in the course of performing those contracts (a notion broadly construed, in scopeFootnote ⁹⁰), in acting with actual or ostensible contractual authority, and so on. By contrast, the focus of failure-to-prevent fraud offences extends beyond a contractual nexus with the wrongdoer, to the presence of an intention to further the commercial objectives of the company through the wrongdoing. Accordingly, failure-to-prevent fraud offences (like their vicarious liability counterparts in the USFootnote ⁹¹) see the company in this respect as a ‘real entity’, an entity with overarching commercial plans and goals, as well as systems, culture and processes.Footnote ⁹² On such a view, to be fairly attributable to the company, fault-based wrongdoing on the part of an associated person must intelligibly have been related to the pursuit of these plans or goals. It is not enough merely that the wrongdoing was engaged in during the course of employment. Whether such a restrictive view of the scope of failure-to-prevent fraud proves acceptable to the public, once its implications become clear, remains to be seen.