In 2011, the Bhabha Atomic Research Centre’s Rare Materials Project needed medicines. It got them, at prices the Central Bureau of Investigation later said were inflated through a rigged tender, funnelled through a scientific officer named Dr. P. Anand who allegedly pocketed a little over forty-two thousand rupees for his trouble. The wrongful loss to the exchequer, on paper, came to a little over three and a half lakh rupees — a rounding error by the standards of Indian white-collar crime. Nobody at the supplying company, Sanofi India, was ever named as an accused. No director signed an incriminating email that surfaced in the chargesheet, no manager confessed, no whistleblower pointed at a specific desk. And yet, this September, the Supreme Court held that the case against the company itself could proceed exactly as it stood — no individual required. It is a small case about medicine and a nuclear-materials agency, and it has just quietly rewritten a foundational rule of Indian criminal law: a corporation no longer gets to hide behind the absence of a human scapegoat.
That is the real news buried in Sanofi India Ltd. v. Central Bureau of Investigation, decided by Justices J.B. Pardiwala and Manoj Misra. For decades, Indian prosecutors chasing corporate crime ran into the same wall. Criminal law, unlike its civil cousin, cares about the mind — mens rea, the guilty intention — and a company famously has no mind of its own to be guilty with. Courts got around this through the doctrine of attribution, borrowed and adapted from English law’s “directing mind and will” test, most notably in the Supreme Court’s own 2011 ruling in Iridium India Telecom v. Motorola: find the human being whose intention counts as the company’s intention, and the company’s guilt follows from his. It sounds elegant. In practice, it became an escape hatch. Defence lawyers learned that if the chargesheet named the company but skipped the individual — because he’d left the country, because internal decision-making was too diffuse to trace to one desk, because investigators simply didn’t dig that deep — you could argue the prosecution had no mind to attribute and ask the High Court to quash the whole thing at the threshold, years before a single witness took the stand. It became less a doctrine of attribution than a doctrine of dismissal.
The identification doctrine has always had this awkward, almost comic quality to it. Its most famous articulation, in the English case of Tesco Supermarkets v. Nattrass in 1971, treated a supermarket chain’s guilt as turning on whether a particular branch manager who mispriced a bag of washing powder counted as the company’s “directing mind” — as though a retail chain’s culpability for a pricing error should hinge on the seniority of the person standing behind the till. Indian courts inherited that logic wholesale, and for a long time even doubted whether a company could be prosecuted at all for offences that carried mandatory imprisonment, since a corporation obviously cannot be sent to jail. It took the Supreme Court’s 2005 ruling in Standard Chartered Bank v. Directorate of Enforcement to settle that a company remains prosecutable even for such offences, with a fine substituted for the sentence a natural person would have served. Sanofi is the next, more consequential step in that same lineage: having accepted that a company can be punished even without a human being physically going to prison, the Court has now accepted that a company can be prosecuted even without a human being formally named at all.
Sanofi closes that door, and it does so with an unusually disciplined piece of judicial engineering. Rather than simply asserting that companies can be prosecuted regardless, the Court built a sequential, three-stage test. First: do the company’s own constitutional documents or the ordinary rules of company law vest a person with the power to have done the act in question? If that fails, second: was that power delegated, expressly or by clear implication, with enough independence and discretion that the delegate’s mind can fairly stand in for the company’s? And if both of those fail, third: does the purpose of the particular statute — one governing atomic energy procurement, say, or environmental discharge, or securities fraud — justify carving out a special attribution rule of its own? Only after working through those three questions does a court decide whether the company can be held to answer. Critically, the Court refused to let any of that analysis happen at the door. Attribution, it said, is “an intricate inquiry,” not a box-ticking exercise, and an intricate inquiry belongs to trial, where evidence can actually be tested — not to a threshold petition where a clever lawyer’s argument is all a judge has to go on. Whether Sanofi India Ltd. is ultimately guilty of anything is a question for the trial court in due course. Whether it can be forced to answer the charge at all is no longer a question that turns on the CBI having found one convenient human being to blame.
It would be easy to read this as a narrow, technical correction — the sort of thing that matters to criminal-procedure specialists and nobody else. It is not. Widen the lens and the Sanofi framework lands in the middle of a much bigger, live argument about how modern institutions get away with things. The same week the Supreme Court was refining corporate attribution in a medicine-procurement case, it was also declining, in Securities and Exchange Board of India v. Vedanta Limited, to let a company treat the release of escrowed funds as a free pass out of fraud proceedings under securities law. Different bench, different statute, same instinct: stop letting corporate structure do the work that evidence should be doing. That instinct matters enormously for the businesses, in-house counsel, and compliance officers who will actually have to live with it. A pharmaceutical company, an infrastructure contractor, a fintech platform can no longer assume that murky internal decision-making is itself a form of insurance — that if wrongdoing can’t be traced to a specific, arraignable person, the corporate entity walks free by default. Compliance is no longer only about preventing individual employees from doing something stupid or venal. It is about the possibility that the company’s own structure and delegation of authority will be read, after the fact, as evidence of the company’s guilty mind, whether or not any single officer is ever put in the dock.
This is where the international comparison becomes useful rather than decorative. Americans have spent more than a decade arguing about exactly this trade-off, mostly in the context of the 2008 financial crisis, when a startling number of banks that helped detonate a global recession paid enormous fines and criminally prosecuted almost nobody of consequence. Eric Holder, then the U.S. Attorney General, told the Senate Judiciary Committee in 2013 that some institutions had grown “too large” for prosecutors to risk charging without threatening the wider economy — remarks that were instantly, and not unfairly, shorthanded in the press as “too big to jail.” Stung by the backlash, Holder later walked the sentiment back on camera, insisting flatly: “There is no such thing as too big to jail.” The trouble is that American prosecutorial practice in the years since has often looked a great deal more like his first instinct than his second — deferred prosecution agreements and record-setting settlements have become the preferred instrument precisely because identifying the culpable individual inside a sprawling institution is so difficult, and because charging the institution itself, criminally, still runs into much the same “who exactly is the guilty mind” problem that Indian courts wrestled with in Iridium. Sanofi is India taking a genuinely different fork in that same road: rather than treating the difficulty of finding an individual as a reason to let the institution off with a civil settlement, the Court has said the difficulty is precisely why the institution’s own guilt has to be assessed on its own footing, tested at trial rather than waved away at the gate.
None of which means the critics of corporate criminal liability are wrong to worry, and an honest reckoning with this shift has to sit with their strongest argument rather than brush past it. A company is not, whatever the fiction of legal personhood pretends, a single mind capable of intending anything. It is thousands of people, layers of delegated authority, decisions made by committees that no one person fully controls. Punish “the company” and in practice you are punishing shareholders who had no say in a rogue procurement officer’s conduct, employees whose jobs depend on the firm’s fines and reputation, sometimes pension funds several steps removed from the wrongdoing. Britain’s own experiment with strict “failure to prevent” corporate offences under its Bribery Act has drawn exactly this criticism — that scrupulously compliant firms can still be swept up for the acts of a single rogue employee acting against every internal policy the company had in place, and that this amounts to punishing diligence-minus-perfection as if it were complicity. It is not a strawman to say that broadening corporate liability risks becoming a blunt instrument that lands on the diffuse and the innocent along with the guilty.
But this is exactly why the architecture the Supreme Court chose in Sanofi deserves more credit than a simple “companies can now be prosecuted without a scapegoat” headline gives it. The Court did not create blanket vicarious liability, where a company answers for literally anything any employee ever does. It built a graduated test that still requires the prosecution to show either formal authority, or a real and traceable delegation of independent discretion, or a considered judgment that the specific statute’s purpose demands attribution — and it left every one of those questions to be proven with evidence at trial, not assumed at the outset. That is a meaningfully different thing from strict liability, and it is a meaningfully different thing from the American pattern of settling with institutions precisely because the individual-guilt puzzle feels too hard to solve. The test asks courts to do the harder, slower work of actually tracing authority and discretion through a company’s real structure, rather than either the easy dismissal of “no named individual, no case” or the easy shortcut of “the company must be guilty of something, so fine it and move on.” It is a demand for more rigour, not less — rigour applied to the corporation’s own decision-making architecture instead of a search for a single fall guy.
There is also a simpler, more human case for the shift, one that the arithmetic of Sanofi’s own facts makes vividly. Three and a half lakh rupees of loss to a body that safeguards India’s rare nuclear materials, and forty-two thousand rupees changing hands, are modest sums by the standards of corporate scandal — which is rather the point. If a case this small can be quashed for want of a named individual, the same logic shields far larger frauds where corporate structures are, by design or by accident, considerably harder to see through than a single scientific officer’s gratification. Every experienced white-collar defence lawyer in the country understood, long before this September, that the fastest route out of a corporate prosecution was often not to contest the facts at all but to note, politely, that the chargesheet had failed to name a natural person. That argument is now considerably weaker, and companies that have spent years treating diffuse, undocumented decision-making as a form of legal camouflage will need to treat it instead as exactly the liability it always should have been.
What the Sanofi framework ultimately asks of Indian businesses, and of the legal professionals who advise them, is a kind of institutional honesty that has been optional for too long. Boards can no longer assume that a well-timed silence about who exactly approved a given tender, a given discharge, a given disclosure, will double as a defence if regulators or investigators come knocking. The three-stage test does not guarantee convictions, and it should not; a genuine trial, with genuine evidence of delegated authority or statutory purpose, is precisely where these questions belong, and companies that can show their decisions were made transparently, with real oversight, still have every reason to expect to be treated fairly under it. But the era in which “we can’t say who decided this” functioned as a get-out-of-court-free card is, after Sanofi, over. For an economy whose growth increasingly depends on the credibility of its regulatory and criminal justice institutions — to investors, to trading partners, to its own citizens — that is not a technical footnote. It is the quiet, overdue end of the idea that a corporation can be too well-organised to be found guilty of anything at all.