On 21 October 2020, Her Majesty’s Revenue and Customs (HMRC) – the UK’s tax authority – released updated figures regarding the number of investigations that it has open into potential offences under Part 3 of the Criminal Finances Act 2017 (the Act). Part 3 of the Act makes it a criminal offence for businesses to fail to put in place reasonable procedures to prevent their employees and associated persons – i.e. those who act for or on behalf of them – from criminally facilitating tax evasion.

According to the information released by HMRC, as at 13 October 2020, HMRC had 13 investigations into potential offences under the Act and a further 18 cases currently under review. HMRC also report that its investigations span 10 different business sectors, including financial services, oils, construction, labour provision and software development, and that those investigations span all HMRC customer groups from small business through to some of the UK’s largest businesses.

The number and range of investigations appear to show that HMRC is actively enforcing the Act across businesses of all shapes and sizes, even despite the pressures on workload and resources caused by the COVID-19 pandemic. This reach, together with potentially unlimited fines for businesses found guilty of the offences, is a salutary reminder that businesses must take their responsibilities seriously and put in place reasonable procedures to stop the facilitation of tax evasion.

In this article, we look at the offence, the defences available and the consequences of falling foul of the law.

What is the offence?

 Two corporate criminal offences known as “CCOs” were introduced on 30 September 2017 under Part 3 of the Criminal Finances Act 2017. The first offence applies to all businesses, wherever located, in respect of the facilitation of UK tax evasion. The second offence applies to businesses with a UK connection in respect of the facilitation of non-UK tax evasion.

In essence, the CCOs make a business (including both companies and partnerships) vicariously liable for any criminal acts of its employees and ‘associated’ persons. Unlike the wide gamut of corporate criminal offences in the U.K. (with the exception of a few corporate crimes including bribery under the UK Bribery Act 2010), a business will be liable for a CCO even if its senior management was not involved in or aware of the facts giving rise to the offence.

There are three stages for the CCOs to apply

  • Stage 1: there must be criminal tax evasion and not merely tax avoidance. “Tax” is broadly defined and includes both corporation taxes (e.g., VAT, employment taxes, etc.) and personal taxes (e.g., income tax).
  • Stage 2: there must be criminal facilitation of the tax evasion by a person ‘associated’ with the business whilst performing services for that business. This definition will include employees, but could also extend to someone with a more remote connection with the business including agents, contractors, suppliers and intermediaries who are performing services for or on behalf of the business. In addition, the associated person must have criminally facilitated the tax evasion whilst providing services to the business. A business will not, therefore, be liable under the CCOs if the associated person was acting in a personal capacity.
  • Stage 3: the business must have failed to implement appropriate and reasonable procedures to prevent the facilitation of tax evasion taking place, or be able to show that it was not reasonable in the circumstances to expect there to be procedures in place.

It is noteworthy that the CCOs have extra-territorial reach. The UK tax evasion offence applies to any business, wherever it is formed or operates. In respect of the evasion of non-UK taxes, a business will commit an offence if the facilitation involves a UK company or partnership, any company or partnership with a place of business in the UK, including a branch, or if any part of the facilitation takes place in the UK.

What defences are available to a potential offence under the CCOs?

It is a defence to an allegation of a CCO having taken place for a business to prove that, when the offence was committed, it had in place “such prevention procedures as it was reasonable in all the circumstances to expect [the business] to have in place” or it was not reasonable in all the circumstances to expect the business to have any prevention procedures in place. “Prevention procedures” means procedures designed to prevent employees and associated persons from committing tax evasion facilitation offences.

As to what might constitute “reasonable prevention procedures”, guidance published by HMRC suggests that there are six guiding principles, namely:

  • risk assessment;
  • proportionality of risk-based prevention procedures;
  • top level commitment;
  • due diligence;
  • communication, including training; and
  • monitoring and review.

Businesses must assess what procedures are reasonable in their individual circumstances, including by undertaking a risk assessment to identify the risks of facilitation of tax evasion within their specific organisation and, thereafter, assess whether there are any gaps in their existing control environment. Businesses with large numbers of consultants, contractors and agents, or which operate cross-border, will want to pay particular attention to the risks associated with those operations. Such risk assessment – and the reasons for any conclusions drawn about potential gaps within the current control environment and, if they exist, how they should be addressed – should be committed to writing, so that it is available in any future investigation.

What are the consequences of committing a CCO?

As well as carrying unlimited financial penalties and the risk of confiscation orders (i.e., to confiscate the proceeds of the crime), committing a CCO will also expose a business to serious reputational damage. A criminal conviction could also affect a business’ ability to bid for public contracts or operate in regulated sectors such as financial services. For those operating in high regulated sectors, such as financial services, a failure to prevent the facilitation of tax evasion could also expose the business and individuals to investigations by other agencies. For example, a firm regulated by the UK’s Financial Conduct Authority may face investigation and sanction for failing to maintain effective systems and controls to prevent financial crime.


Whilst some businesses are hoping that they can turn their focus away from compliance issues to concentrate on surviving the current COVID-19 pandemic, HMRC continue to investigate CCOs and indeed appear to be increasing the number of investigations. Businesses would be well advised to ensure that the procedures that they have in place to address the risk of the facilitation of tax evasion are adequate, maintained and regularly reviewed. As the figures released by HMRC show, this is not something that is going away.