London Investigations Horizon Scan May 2026

Why It Matters

These reforms raise compliance costs and enforcement risk for UK and EU firms, compelling stronger governance and data‑security measures. Failure to adapt could result in unlimited fines, criminal liability, or exclusion from key markets.

Key Takeaways

• Crime & Policing Act 2026 extends senior‑manager test to all offences
• SFO interim director McNulty pledges AI‑driven enforcement and crypto focus
• OFSI doubles maximum sanctions penalty and adds settlement scheme
• New end‑use licence requirement targets export diversion to sanctioned parties
• EU Omnibus raises CSRD/CS3D thresholds, cutting scope for 80% of firms

Pulse Analysis

The Crime and Policing Act 2026 marks a watershed moment for corporate governance in the United Kingdom. By applying the senior‑manager attribution test to every criminal offence, the legislation removes the need to prove a benefit to the organisation, eroding a traditional defence. Companies must now embed comprehensive compliance frameworks that monitor senior‑level conduct across all business lines, from finance to operations, to avoid unlimited fines and criminal prosecution. This shift aligns the UK with a global trend toward stricter accountability, prompting boards to reassess risk registers and internal controls.

Enforcement agencies are also stepping up their capabilities. The Serious Fraud Office, under interim director Graham McNulty, has outlined a business plan that leans heavily on artificial intelligence and technology‑assisted review to accelerate case handling, while expanding its crypto‑asset investigation unit. Simultaneously, the Office of Financial Sanctions Implementation (OFSI) has doubled its maximum penalty for sanctions breaches and introduced a settlement scheme, signalling a tougher stance on illicit finance. The recent penalty against Apple Distribution International—approximately $808,000 in U.S. dollars—illustrates OFSI's willingness to assert jurisdiction over non‑UK entities that act within the UK financial system.

Across the Atlantic, the EU’s Omnibus Directive reshapes sustainability reporting by raising employee and turnover thresholds for the CSRD and CS3D, effectively removing 80% of firms from mandatory disclosure. While this eases reporting burdens for many, it also concentrates scrutiny on larger multinationals, demanding more granular risk‑based assessments and robust due‑diligence processes. Companies operating in both jurisdictions must navigate divergent compliance regimes, integrating AI‑driven monitoring tools, updated sanctions licensing procedures, and expanded ESG reporting into a unified governance model. Failure to do so could expose firms to significant financial penalties, reputational damage, and operational disruption.