Corporate Criminal Offence (CCO): a guide for UK businesses

Failing to prevent tax evasion: what you need to know

The corporate offence of failure to prevent the facilitation of tax evasion, introduced under the Criminal Finances Act 2017, remains a critical area of compliance for UK businesses. With HMRC actively investigating and reviewing cases, this legislation is no longer a theoretical risk, but a real and growing area of enforcement.

What is the Corporate Criminal Office (CCO)?

The legislation makes it a criminal offence for a company, partnership, or other legal entity to fail to take reasonable steps to prevent its employees or associated persons from facilitating tax evasion. It applies to:

• UK tax evasion: all legal persons (eg companies, partnerships, LLPs, charities etc), regardless of location or commercial activity, are covered if UK tax evasion is facilitated.
• Foreign tax evasion: applies to UK-connected businesses involved in the facilitation of non-UK tax evasion, including foreign entities with a UK presence or where facilitation occurs in the UK.

Why is it important?

HMRC has moved from a light-touch approach to active enforcement. Investigations often begin as routine inquiries, such as payroll or benefits reviews, and escalate when signs of facilitation are uncovered. Even minor infractions, like undocumented cash payments, can trigger scrutiny.

Targeted sectors include accountancy, legal, software, logistics, real estate, and financial services, with a particular focus on high-net-worth individuals and their advisers.

Key definitions and legal scope

To understand how the CCO applies, it’s important to clarify two core terms used in the legislation:

• ‘Relevant body’ refers to incorporated entities such as companies and partnerships. Notably, trusts are excluded from this definition.
• ‘Associated persons’ includes any employee, agent, contractor, or intermediary who performs services for or on behalf of the relevant body. The definition is intentionally broad to capture a wide range of relationships, including third-party insurance providers and corporate agents.

The legislation is deliberately far-reaching. By encompassing those who ‘perform services for or on behalf of’ a business, it ensures liability can extend beyond direct employees to include external parties who may facilitate tax evasion.

Strict liability and conditions for offence

The CCO is a strict liability offence, meaning that a business can be held criminally liable even if senior management was unaware of the facilitation. Liability arises when two conditions are met:

1. A taxpayer commits the criminal offence of tax evasion.
2. An associated person of the relevant body criminally facilitates that tax evasion.

Importantly, it’s not necessary for any tax evasion to be successful, or for the taxpayer to be prosecuted. However, if the taxpayer’s actions are limited to administrative non-compliance (such as late filings) and do not amount to tax fraud, the offence does not apply.

Legal tax planning remains outside the scope of the offence.

If both conditions are satisfied, the relevant body will be deemed to have committed the offence – unless it can demonstrate that reasonable prevention procedures were in place.

What are the risks?

If a business is found to have failed to prevent the facilitation of tax evasion, it may face:

• A criminal conviction,
• Unlimited financial penalties,
• Confiscation orders,
• Serious Crime Prevention Orders, or
• Significant reputational damage.

HMRC’s six guiding principles

To demonstrate compliance with the CCO legislation, HMRC expects businesses to adopt and evidence ‘reasonable steps’ or ‘realistic measures’ to prevent the facilitation of tax evasion. These steps are not prescriptive, but HMRC has outlined six guiding principles to help organisations assess and implement appropriate procedures.

These principles provide a framework for what HMRC considers to be reasonable, and they form the basis of any defence a business may need to present in the event of an investigation:

1. Risk assessment
   Businesses should conduct and document a thorough risk assessment (ideally on an annual basis) to identify where tax evasion facilitation risks may arise. This is the foundation of a compliant framework and helps determine whether existing controls are sufficient.
2. Proportionality of risk-based prevention procedures
   Prevention measures should be proportionate to the size, complexity, and risk profile of the business. HMRC recognises that not all organisations face the same level of risk (eg charities), and procedures should reflect this without being excessively burdensome.
3. Top level commitment
   Senior management must be visibly involved in the development and implementation of preventive measures. A strong tone from the top is essential to embed a culture where tax evasion is clearly unacceptable.
4. Due diligence
   Appropriate due diligence should be carried out based on the level of risk of an offence being committed. These checks should be documented and regularly reviewed.
5. Communication and training
   Policies and expectations must be clearly communicated across the organisation. Regular training should be provided to ensure staff and associated persons understand how to identify and respond to potential tax evasion risks.
6. Monitoring and review
   Businesses must regularly monitor and review their procedures to ensure they remain effective and relevant. This includes updating policies in response to changes in business operations, risk exposure, or regulatory expectations.

How we can help

At Saffery, we offer a comprehensive suite of services to help businesses comply with CCO regulations and protect themselves from liability, including:

Risk assessments

We conduct tailored, in-depth risk assessments to identify vulnerabilities and document your compliance position.

Internal audits

Our team can perform internal reviews of your processes and controls, highlighting areas for improvement.

Policy development

We assist in drafting and implementing proportionate prevention procedures, including updates to contracts and codes of conduct.

Training and awareness

We deliver bespoke training sessions in a format that suits your business, whether in person, via Teams or Zoom, or through customised web-based learning modules that can be integrated into your existing compliance or onboarding programmes.

Supplier and customer due diligence

We can perform due diligence on third parties to assess their compliance posture.

Ongoing support

We offer periodic reviews to ensure your procedures remain effective and up to date.

M&A and audit advisory

We support clients during transactions and audits, helping to identify and mitigate CCO-related risks that could impact valuations or lead to indemnities.

Get in touch

The Corporate Criminal Offence is an established risk that businesses must actively manage. Whether you’re a multinational or an owner-managed business, the expectation is clear: take reasonable steps, document your efforts, and foster a culture of compliance.

For more information or to discuss how we can support your business, please get in touch with Zoe Thomas.

Over on our Business Talks podcast channel, Zoe joins host Jamie Lane to explore CCO regulations and the potential impact to UK businesses. Listen here.