Criminal Finances Act: are you prepared?

Susie Walker

Susie Walker

Partner & Head of Tax

29 September 2017

The UK’s new Corporate Criminal Offence of failing to prevent the facilitation of overseas and domestic tax evasion – Are you prepared?

The focus on tax transparency is heightening.  A current example is the UK’s Corporate Criminal Offence for the Failure to Prevent the Facilitation of Tax Evasion (CCO), which is now law and will be effective from 30 September 2017. 

In this article, we explain the wider context in which the legislation will operate, why every business either doing business in, with or through the UK needs to consider the legislation, and the view from HMRC as to how businesses should respond by 30 September 2017.

The new offence of failing to prevent third-party tax evasion

The new offence concerns an ‘associated person’ such as an employee, agent, contractor or subsidiary acting on behalf of a business who facilitates the evasion of tax by a third party.

If that business cannot evidence that it had reasonable preventative procedures in place to prevent the facilitation of tax evasion by persons acting on its behalf, then it could be subject to a corporate criminal conviction.  A successful public prosecution could result in an unlimited fine. The repercussions are likely to have far-reaching consequences for regulated businesses such as the revocation of licenses in some countries. Furthermore, organisations may find themselves barred from public procurement processes and face reputational damage.

HMRC is not expecting organisations to put in place fail-safe procedures to stop their clients and customers from committing tax evasion, or stopping the de facto tax evasion itself. Instead it expects businesses to take a risk-based approach and to be doing all that is ‘reasonable’ to prevent their people, service providers and third parties acting on their behalf from being knowingly concerned in facilitating tax evasion by third parties globally.

The tax evasion can be anywhere in the world and applies to all taxes.

What are ‘reasonable procedures’?

To respond to the legislation, HMRC recommends that businesses should put in place procedures that are proportionate to the risks they face, using HMRC’s six principles as a guide:

  • Risk assessment
  • Proportionality of risk-based prevention procedures
  • Top level commitment
  • Due diligence
  • Communication
  • Monitoring and review

Act now to meet the September deadline

By September 2017 any business seeking to ensure that it has a defence of reasonable procedures should have identified, documented and categorised the specific risks of facilitation of tax evasion across their organisation, identified the controls already in place to manage those risks, and devised a plan to address any control shortcomings or other necessary actions to address the risks identified.

Risk assessment – the first response

The risk assessment drives the response to the legislation – until you identify where your risks arise it is impossible to know whether existing controls sufficiently manage the risk.

A logical starting point is to risk-assess your business operations by considering the geographies, products, supplies, relationships and motivations that could result in a facilitation of tax evasion risk.  Identifying the ‘associated persons’ of the business and the risks of facilitation can ensure a focus on key risk areas. It can also be helpful to consider who the counterparties to your transactions are who could potentially be evading tax, and then identify where facilitation could arise – for example customers, suppliers and employees.

Once you have identified and prioritised your risks, a plan can then be built to address any gaps in controlling procedures.  Any response should include top-level board commitment from the organisation as well as sustained communication which can be facilitated through training.


Businesses have a limited time to carry out their risk assessment processes.  Our experience is that by gathering together key members of the business to perform an initial assessment of the risk of facilitation across the business, a plan of action can quickly be formulated. 

Will you be ready in time for the September deadline?