The Complete Section 250 Compliance Guide

What is Section 250?

Section 250 of the Crime and Policing Act 2026 is a corporate attribution mechanism. Where a "senior manager" of a body corporate or partnership commits a criminal offence under the Act within the actual or apparent scope of their authority, the organisation itself is treated as having committed that offence. Section 250(3) defines "senior manager" as an individual who plays a significant role in (a) the making of decisions about how the whole or a substantial part of the activities of the body corporate or partnership are to be managed or organised, or (b) the managing or organising of the whole or a substantial part of those activities.

The test covers all organisational activities — not only financial ones — and is independent of FCA approval status. This is not a standalone criminal offence for failing to hold declarations. It is a mechanism that attributes the criminal conduct of qualifying senior managers to their organisation. The practical effect: organisations need to know who their "senior managers" are under this definition, because any qualifying criminal act those individuals commit in scope of their authority becomes the organisation's liability.

The legislation was passed in recognition that existing frameworks did not fully address the gap between individual criminal accountability and corporate liability. Section 250 fills that gap by making senior organisational decision-makers a defined risk point for their employers.

Who is in scope?

The s.250(3) test asks whether an individual plays a significant role in (a) the making of decisions about how the whole or a substantial part of the activities of the organisation are to be managed or organised, or (b) the managing or organising of the whole or a substantial part of those activities. The test is based on organisational authority and decision-making scope — not job title, FCA registration status, or whether their role is specifically financial.

Individuals typically in scope include: chief executive officers, chief operating officers, chief financial officers, heads of major business divisions, senior portfolio managers with discretionary authority over significant mandates, heads of risk and compliance with oversight of substantial operations, and directors of material subsidiary entities with a UK nexus. The common thread is that these individuals make or shape decisions about how a substantial part of the organisation operates — whether or not they hold a formal SMF or Certified Function designation.

Critically, s.250 is not limited to FCA-regulated firms. It applies to all UK bodies corporate and partnerships. FCA-regulated firms are particularly well-positioned to run the gap analysis because SM&CR provides a documented baseline of approved persons — making the gap visible.

How to run the gap analysis

The gap analysis is the foundation of a robust Section 250 risk management process. It requires you to compare two populations: everyone currently approved or certified under SM&CR at your firm, and everyone who meets the s.250(3) functional test — playing a significant role in managing or organising a substantial part of the organisation's activities (whether or not they are approved).

Step one is obtaining your FCA register extract for your firm(s). This is available via the FCA Register Extract Service and identifies every approved person associated with your FRN. Step two is preparing a list of all individuals who meet the s.250(3) functional test at your firm. This requires judgment — a mechanical job-title filter will miss people and over-include others. The test is about organisational authority, not title. Step three is comparing the two lists. Everyone on the second list but not on the first represents your potential Section 250 exposure.

The declaration cycle

The declaration cycle is CoverProof's recommended approach to building a documented, auditable record of your Section 250 risk management process. While s.250 does not itself mandate declarations, having signed declarations from every individual identified in your gap analysis provides the strongest evidential record that your organisation identified its exposure and took positive steps to address it.

Each declaration should identify the individual, their role, the basis on which they were assessed as meeting the s.250(3) test, and their acknowledgement of the obligation. Declarations must be timestamped and traceable to the gap analysis that generated them. A declaration stored in a shared drive folder with no audit trail provides limited evidentiary value. The declaration cycle must include: sending formal declaration requests with delivery confirmation, tracking responses and non-responses, chasing outstanding declarations with documented attempts, and handling any refusals with escalation to the board.

The board evidence pack

Your board needs to demonstrate that it identified the Section 250 risk and acted before June 29, 2026. This requires a well-documented evidence pack containing: the gap analysis methodology and results, all declarations sent and received with timestamps, any re-send attempts for non-responders, and an executive summary for board sign-off.

CoverProof generates evidence packs in PDF/A-3B format (ISO 19005-3 compliant) with a SHA-256 cryptographic hash recorded at generation time. These properties ensure the document cannot be modified after the fact and that its provenance is verifiable — the same documentation characteristics required in regulatory and legal proceedings. Courts determine admissibility; the pack provides the strongest evidential foundation currently achievable for this type of compliance record. A formal board resolution or minute acknowledging the analysis and confirming completion should be retained alongside the pack.

Ongoing obligations

Section 250 is not a one-time exercise. Declarations expire and must be renewed — annually, or sooner if there is a material change to the individual's role. The population of individuals in scope changes as staff join, leave, or change roles. New significant hires must be assessed against Section 250 criteria at onboarding.

An annual review cycle should be built into your compliance calendar. Each cycle requires a fresh gap analysis, a declaration renewal cycle for all existing declarations approaching expiry, and an updated board evidence pack.

Detailed guides in this cluster

This page is the overview. The articles below go deeper on each part of Section 250 — read them alongside this guide.

Frequently asked questions

Primary sources

Statutory claims on this page reference the following primary materials. Verify any decision against them directly.

• Crime and Policing Act 2026, s.250 — legislation.gov.uk — verbatim enacted text of the senior-manager attribution provision.
• Crime and Policing Act 2026, full Act — legislation.gov.uk — table of contents and surrounding offences referenced by s.250.
• FCA — Senior Managers and Certification Regime (SM&CR) — the regulatory framework that defines the SM&CR baseline against which the s.250(3) test is gap-analysed.
• FCA Handbook — SYSC (Senior Management Arrangements, Systems and Controls) — primary source for Senior Manager Function (SMF) definitions used during gap analysis.
• FCA Financial Services Register — authoritative public record of FCA-approved persons and their function codes; used during AI classification when API access is configured.

CoverProof links to primary sources at their canonical URLs. If a link is unreachable, refer to the named publication directly — legislation.gov.uk and fca.org.uk remain the authoritative homes for these materials.