The Corporate Criminal Offence (CCO) makes it illegal for companies and partnerships of any size to fail to prevent the facilitation of tax evasion.
Many businesses will already have addressed CCO and have some form of preventative procedures in place, but haven't reviewed their work since the legislation was introduced or tested that the procedures are operating effectively. You should do regular reviews to check if your existing processes are appropriate.
Others are relying on wider financial crime policies and procedures, such as anti-bribery and corruption, to be sufficient for CCO purposes. While this is often a good starting point, solely relying on these policies and procedures isn't a sufficient defence in the event of prosecution.
The primary intention of ‘failure to prevent’ legislation is to drive this kind of behavioural change and to encourage businesses to be proactive in putting in place preventative procedures that reduce the opportunity for facilitation to occur. However, some companies are doing nothing at all, either because they're unaware of it, or because there is a perception that HMRC aren’t taking action. Securing prosecutions remains a priority for HMRC and the first prosecution is now going through the court system. This, alongside the new Failure to Prevent Fraud offence which came into effect in September 2025, means that it is as important as ever to ensure action is taken.
HMRC has stated that for procedures to be sufficient as a defence for preventing the facilitation of tax evasion they need to be informed by six guiding principles.
This is essential to knowing what risks your business faces and if you have appropriate procedures in place to address those risks. The risk assessment should be documented and kept under review.
Businesses aren't required to undertake excessively burdensome procedures. They should be implemented based on the size, complexity, and the risk identified in the risk assessment.
Senior management is expected to foster a culture where the facilitation of tax evasion is never acceptable. They should be involved in the development and review of preventative procedures, together with communicating the position adopted by the business.
This scrutiny should be undertaken on people who perform or will perform services on behalf of the business – an 'associated person', so that risks can be identified and appropriate mitigations put in place. An associated person is an employee or agent, or anyone who performs services for or on behalf of a business.
The policies and procedures should be communicated, embedded, and understood throughout the business. General training should be provided, with consideration given to the more specific training needs of higher-risk associated persons.
The risk assessment and procedures should be continually monitored and reviewed. This should happen at least annually, and when there are any significant changes in the business.
We've developed a methodology that pinpoints the most important areas and guides businesses through developing robust preventative measures tailored to their needs – helping them to stay ahead of compliance risks and potential penalties.
We work with them to identify the existing controls and processes already in place and make them part of the reasonable procedures.
If the ‘review’ discovers key risks or deficiencies, we develop a realistic action plan to implement our recommendations and ensure businesses have a robust CCO framework. There are typically two areas where further support is required: policy development and training. We help businesses develop policies, and meet training requirements through an eLearning module and bespoke sessions.
No framework is complete without testing that establishes whether controls are operating effectively. Our approach combines internal audit methodology with tax expertise to ensure they're robust.
The final guiding principle from HMRC is that the risk assessment is maintained and kept up to date with key changes from within the business or within its operating environment. We would work with you to embed this into your existing risk and governance framework and provide any additional support you request.
Getting your CCO compliance right can protect you from unlimited fines, reputational damage, and other commercial issues.
For more insight and guidance, get in touch with Sam Dean or Michelle Perry.
Sign up to get the latest role, industry or technical updates by email