What is the defence to the CCO?

The defence is having reasonable prevention procedures in place, or it being not reasonable to have any procedures. HMRC's guidance sets out six guiding principles: risk assessment, proportionality, top-level commitment, due diligence, communication, and monitoring and review. The company has a defence to the CCO if it can show that: (1) Reasonable prevention procedures — the company had reasonable prevention procedures in place to prevent the facilitation of tax evasion. The procedures should be designed to prevent the associated persons (employees, agents, subcontractors) from criminally facilitating tax evasion. (2) Not reasonable to have procedures — in some cases, it may not be reasonable to have any prevention procedures (e.g., if the company has no associated persons, or the risk is negligible). HMRC's guidance sets out six guiding principles for reasonable prevention procedures: (1) Risk assessment — the company should assess its exposure to the risk of tax facilitation. The assessment should consider: (a) the types of associated persons (employees, agents, subcontractors), (b) the nature of the business, (c) the jurisdictions in which the company operates, and (d) the types of transactions and customers. (2) Proportionality — the prevention procedures should be proportionate to the risk. A company with a high risk of tax facilitation (e.g., a financial services company with overseas operations) should have more extensive procedures than a company with a low risk (e.g., a small UK retail company). (3) Top-level commitment — senior management (the board or partners) should be committed to preventing tax facilitation. This includes: (a) a clear statement of the company's commitment, (b) allocation of responsibility for the prevention procedures, and (c) board-level oversight. (4) Due diligence — the company should conduct due diligence on associated persons, especially those who may pose a higher risk (e.g., agents in high-risk jurisdictions, new employees in sensitive roles). (5) Communication — the company should communicate its prevention procedures to all associated persons (e.g., through training, policies, and contracts). (6) Monitoring and review — the company should regularly monitor and review its prevention procedures, and update them as needed. The procedures should be documented, and the company should keep records of the risk assessment, policies, training, due diligence, and monitoring. Relevant legislation: Criminal Finances Act 2017, Section 48 (defence); HMRC Guidance on Corporate Criminal Offence (six guiding principles). Example: A company conducts a risk assessment and identifies that its overseas agents pose a risk of tax facilitation. It implements prevention procedures: a tax evasion policy, due diligence on overseas agents, training for staff, and annual monitoring. If an overseas agent criminally facilitates tax evasion, the company has a defence — it had reasonable prevention procedures in place. Common mistake: Implementing prevention procedures that are not proportionate to the risk. A small UK company with no overseas operations and no agents does not need the same procedures as a multinational financial services company. The procedures should be tailored to the company's specific risk profile.

Who is an 'associated person' under the CCO?

An associated person is anyone who performs services for or on behalf of the company, including employees, agents, subcontractors, and other persons who act for the company. The key test is whether the person performs services for the company. Under the CCO, an 'associated person' is a person who performs services for or on behalf of the company. The definition is broad and includes: (1) Employees — all employees are associated persons (they perform services for the company). (2) Agents — persons who act as agents for the company (e.g., sales agents, commission agents, brokers). (3) Subcontractors — persons who provide services to the company as subcontractors (e.g., IT contractors, cleaning contractors, security contractors). (4) Professional advisers — persons who provide professional services to the company (e.g., accountants, lawyers, tax advisers) — but only if they perform services for or on behalf of the company (not just advising the company). (5) Other persons — any other person who performs services for or on behalf of the company, regardless of the capacity in which they act. The key test is whether the person performs services for the company. The test is not based on the legal relationship (e.g., employee vs contractor) but on the practical reality — if the person performs services for the company, they are an associated person. The broad definition means that the CCO can apply to a wide range of relationships, and companies should consider all persons who perform services for them when assessing their risk and implementing prevention procedures. Relevant legislation: Criminal Finances Act 2017, Section 49 (associated persons); HMRC Guidance on Corporate Criminal Offence (associated persons). Example: A company uses an overseas sales agent to sell its products in a foreign market. The agent is an associated person (they perform services for the company). If the agent criminally facilitates tax evasion by a customer (e.g., by helping the customer to hide income), the company may be liable under the CCO (if it did not have reasonable prevention procedures in place). Common mistake: Assuming that only employees are associated persons. The definition is broad and includes agents, subcontractors, and other persons who perform services for the company. Companies should consider all associated persons when assessing their risk and implementing prevention procedures.

What are the consequences of a CCO conviction?

A CCO conviction can result in: unlimited fines, reputational damage, disqualification from public contracts, director disqualification, and regulatory consequences. The consequences can be severe, making prevention procedures essential. A CCO conviction can have severe consequences for a company: (1) Unlimited fines — the CCO is a criminal offence, and the fine is unlimited. The fine is determined by the court, based on the severity of the offence and the company's financial position. For large companies, the fine can be in the millions of pounds. (2) Reputational damage — a criminal conviction for facilitating tax evasion can cause significant reputational damage. The conviction is public, and the company's name and reputation may be damaged in the eyes of customers, suppliers, investors, and the public. (3) Disqualification from public contracts — a CCO conviction may result in disqualification from bidding for public contracts (under the Public Procurement Regulations). This can be a significant commercial disadvantage for companies that rely on public sector contracts. (4) Director disqualification — directors of the company may face disqualification under the Company Directors Disqualification Act 1986, if they were involved in the failure to prevent tax facilitation. (5) Regulatory consequences — for regulated companies (e.g., financial services companies), a CCO conviction may result in regulatory consequences (e.g., loss of licence, regulatory fines, or restrictions on activities). (6) Loss of business — customers and suppliers may choose to do business with other companies, resulting in loss of revenue. (7) Insurance — the company's insurance may not cover criminal fines, and the company may face increased insurance premiums. The severe consequences make it essential for companies to implement reasonable prevention procedures and to take the CCO seriously. Specialist advice is recommended to ensure that the procedures are adequate and that the company is protected. Relevant legislation: Criminal Finances Act 2017, Sections 45-47 (CCO offences and penalties); Public Procurement Regulations (disqualification); Company Directors Disqualification Act 1986 (director disqualification). Example: A company is convicted under the CCO for failing to prevent its sales agent from facilitating tax evasion. The company is fined £5 million (based on the severity and the company's financial position). The company is also disqualified from bidding for public contracts for 5 years, and its finance director is disqualified for 3 years. The reputational damage results in the loss of several major customers. Common mistake: Underestimating the consequences of a CCO conviction. The fines, reputational damage, and disqualification from public contracts can be severe and long-lasting. Companies should take the CCO seriously and implement adequate prevention procedures.

How do I implement CCO prevention procedures?

Implement prevention procedures by: conducting a risk assessment, developing proportionate policies, training staff, conducting due diligence on associated persons, communicating procedures, and monitoring and reviewing. Document all steps. Specialist advice is recommended. To implement reasonable CCO prevention procedures: (1) Conduct a risk assessment — assess the company's exposure to the risk of tax facilitation. Consider: (a) the types of associated persons (employees, agents, subcontractors), (b) the nature of the business, (c) the jurisdictions in which the company operates (especially high-risk jurisdictions), (d) the types of transactions and customers, and (e) any previous incidents or near-misses. Document the risk assessment and the findings. (2) Develop proportionate policies — create policies and procedures that are proportionate to the identified risk. These may include: (a) a tax evasion policy (stating the company's zero-tolerance approach to tax facilitation), (b) a whistleblowing policy (encouraging employees to report concerns), (c) a due diligence process for associated persons (especially agents and subcontractors in high-risk areas), (d) a training program for employees, and (e) a monitoring and review process. (3) Train staff — train all employees on the CCO rules, the company's prevention procedures, and how to identify and report tax facilitation. Training should be tailored to the employee's role and risk exposure. (4) Conduct due diligence — conduct due diligence on associated persons, especially those in high-risk roles or jurisdictions. Due diligence may include: (a) background checks, (b) reference checks, (c) screening for previous involvement in tax evasion, and (d) review of the associated person's own prevention procedures. (5) Communicate — communicate the prevention procedures to all associated persons. This may include: (a) incorporating the procedures into employment contracts and agency agreements, (b) providing written policies to employees, and (c) requiring agents and subcontractors to confirm their compliance with the procedures. (6) Monitor and review — regularly monitor and review the procedures to ensure they remain effective. This may include: (a) annual review of the risk assessment, (b) review of the policies and procedures, (c) review of training effectiveness, (d) monitoring of associated persons' compliance, and (e) updating the procedures as needed. (7) Document — keep records of all steps taken, including the risk assessment, policies, training, due diligence, and monitoring. These records are the evidence that the company had reasonable prevention procedures in place (if needed for the defence). Specialist advice is recommended to ensure the procedures are adequate and tailored to the company's risk profile. Relevant legislation: Criminal Finances Act 2017, Section 48 (defence); HMRC Guidance on Corporate Criminal Offence (six guiding principles). Example: A company with overseas agents conducts a risk assessment and identifies that the agents pose a high risk of tax facilitation. It implements prevention procedures: a tax evasion policy (stating zero tolerance), due diligence on all overseas agents (background checks and reference checks), annual training for all staff, incorporation of the procedures into agency agreements, and annual monitoring and review. The company documents all steps taken. If an overseas agent criminally facilitates tax evasion, the company has a defence — it had reasonable prevention procedures in place. Common mistake: Implementing generic prevention procedures that are not tailored to the company's specific risk profile. The procedures should be proportionate to the identified risk — a one-size-fits-all approach may not be adequate.

Tax Disputes › Investigations

Corporate Criminal Offence: Failure to Prevent Tax Facilitation

The CCO rules make companies criminally liable for failing to prevent tax evasion by their staff or agents. Understand the rules, the defence, and how to implement reasonable prevention procedures.

Book a Consultation +44 (0) 800 211 8657

The Corporate Criminal Offence (CCO) of failure to prevent the criminal facilitation of tax evasion was introduced in 2017 as part of the UK's efforts to combat tax evasion. The CCO makes companies criminally liable if a person associated with the company (e.g., an employee, agent, or subcontractor) criminally facilitates tax evasion, and the company failed to have reasonable prevention procedures in place. The CCO has significant consequences — a criminal conviction can result in unlimited fines, reputational damage, and disqualification from public contracts. Understanding the CCO rules and implementing reasonable prevention procedures is essential for all companies, not just those in the financial sector.

The Three Offences

The CCO regime created three offences: (1) Failure to prevent UK tax evasion facilitation — a UK company is liable if a person associated with the company criminally facilitates UK tax evasion. (2) Failure to prevent foreign tax evasion facilitation — a UK company is liable if a person associated with the company criminally facilitates foreign tax evasion (under certain conditions). (3) Failure to prevent foreign tax evasion facilitation (overseas companies) — an overseas company is liable if a person associated with the company criminally facilitates foreign tax evasion and the company has a UK connection.

How the Offence Works

The CCO is a 'failure to prevent' offence. The company is liable if: (1) Stage 1 — a person (e.g., a customer or client) commits tax evasion (criminal evasion, not just avoidance). (2) Stage 2 — a person associated with the company (e.g., an employee, agent, or subcontractor) criminally facilitates the tax evasion (e.g., by helping the person to evade tax). (3) Stage 3 — the company failed to have reasonable prevention procedures in place (or it was not reasonable to have any procedures). All three stages must be met for the offence to be committed. The company does not need to have intended to facilitate tax evasion — the offence is one of strict liability (subject to the defence of reasonable prevention procedures).

The Defence

The company has a defence if it can show that it had reasonable prevention procedures in place, or that it was not reasonable to have any procedures. HMRC's guidance sets out six guiding principles for reasonable prevention procedures: (1) Risk assessment — assessing the company's risk of tax facilitation. (2) Proportionality — procedures should be proportionate to the risk. (3) Top-level commitment — senior management should be committed to preventing tax facilitation. (4) Due diligence — conducting due diligence on associated persons. (5) Communication — communicating the procedures to staff and agents. (6) Monitoring and review — regularly monitoring and reviewing the procedures.

Implementing Prevention Procedures

To implement reasonable prevention procedures: (1) Conduct a risk assessment — identify the company's exposure to tax facilitation risk (e.g., through employees, agents, or subcontractors). (2) Develop policies — create policies and procedures to prevent tax facilitation (e.g., a tax evasion policy, a whistleblowing policy, and a due diligence process for associated persons). (3) Train staff — train employees on the CCO rules and the company's prevention procedures. (4) Conduct due diligence — conduct due diligence on agents, subcontractors, and other associated persons. (5) Monitor and review — regularly monitor and review the procedures, and update them as needed. (6) Document — keep records of the risk assessment, policies, training, due diligence, and monitoring. Specialist advice is recommended to ensure the procedures are adequate.

Key Points

What You Need to Know

The CCO makes companies criminally liable for failing to prevent tax facilitation by associated persons
Three offences: UK tax evasion facilitation, foreign tax evasion facilitation, and overseas companies
The defence is having reasonable prevention procedures in place
HMRC's six guiding principles: risk assessment, proportionality, top-level commitment, due diligence, communication, monitoring
A criminal conviction can result in unlimited fines, reputational damage, and disqualification from public contracts

Expert Answers

Tax Disputes Frequently Asked Questions

Detailed answers with legislation references, practical examples and common pitfalls.

Explore More

All Tax Disputes Topics

HMRC Self-Assessment Enquiries Code of Practice 8 (COP8)Code of Practice 9 (COP9)HMRC Penalties Statutory Reviews of HMRC Decisions First-tier Tribunal (Tax Chamber)Alternative Dispute Resolution (ADR)Worldwide Disclosure Facility (WDF)HMRC Nudge Letters HMRC Offshore Disclosure Campaigns HMRC Discovery Assessments HMRC Information Notices Corporate Criminal Offence: Failure to Prevent Tax Facilitation VAT Disputes & Tribunals IR35 & Off-Payroll Working Disputes Transfer Pricing Disputes

Need Specialist Tax Disputes Advice?

Our tax advisers can help you navigate tax disputes with clear, practical advice tailored to your circumstances.

Book a Consultation Call +44 (0) 800 211 8657