What Is the Corporate Criminal Offence? A Guide for UK Business Owners

The Corporate Criminal Offence has been in place since 30 September 2017, brought in under the Criminal Finances Act 2017.

It covers two offences: failing to prevent the facilitation of UK tax evasion, and failing to prevent the facilitation of foreign tax evasion. Size and sector don’t matter. It applies to companies and partnerships of any size, in any industry, including businesses based outside the UK if there’s a UK connection.

What makes the CCO different from other corporate offences?

It’s a strict liability offence. Prosecutors don’t need to prove senior management knew about the wrongdoing, or directed it. A business can be exposed even when the people running it had no idea anything was happening. That’s what catches most businesses off guard.

When does a CCO actually arise? The three-stage test

All three have to be true at once:

1. Criminal tax evasion. A taxpayer, whether an individual or an entity, commits a criminal offence of tax evasion under existing law.
2. Criminal facilitation by an associated person. Someone “associated” with the business (an employee, agent, or anyone else performing services for it or on its behalf) criminally facilitates that evasion while acting in that capacity.
3. Failure to prevent. The business failed to prevent that facilitation taking place.

If all three elements line up, there’s exactly one statutory defence available.

What’s the only defence?

The only statutory defence is showing the business had reasonable prevention procedures in place at the time, or that it wasn’t reasonable to expect any given the circumstances. HMRC guidance sets out six guiding principles that reasonable prevention procedures should reflect. Procedures should be proportionate to the risks the business faces, and kept under regular review:

• Risk assessment: has the business actually assessed where, across its operations and supply chain, facilitation could occur?
• Proportionality: are the procedures proportionate to the risks the business genuinely faces, not a generic template?
• Top-level commitment: is there visible commitment from senior leadership, not just a policy sitting in a folder?
• Due diligence: is due diligence actually being carried out on associated persons?
• Communication and training: do the people who need to know about this actually know about it?
• Monitoring and review: is the whole thing reviewed regularly, or was it written once and left?

What happens if a business is found liable?

The penalties aren’t proportionate to how contained the issue felt internally. They include:

• Unlimited financial penalties, set at the court’s discretion
• Ancillary orders, including confiscation orders and serious crime prevention orders
• A public record of conviction, with the reputational damage that comes with it
• Potential exclusion from public sector tenders and procurement processes
• Increased scrutiny from HMRC, regulators, and prospective business partners or funders

How can a business start building CCO prevention procedures?

Sedulo Tax Advisory supports businesses at any stage of this, including:

• CCO risk assessments across the business, its supply chain, and associated persons
• Designing and drafting prevention procedure policies and governance documentation
• Staff and third-party training and awareness sessions
• Ongoing monitoring, review, and health-check support

FAQ

Does the Corporate Criminal Offence only apply to large businesses?

No. Unlike some other UK corporate offences, the CCO applies to companies and partnerships of any size and any sector, including bodies established outside the UK where there’s a UK nexus. There’s no employee-count or turnover threshold that exempts a business.

What counts as an “associated person”?

Anyone performing services for the business or on its behalf while acting in that capacity. That typically includes employees and agents, but it can extend further depending on the relationship and the services being provided.

Is having a written prevention policy enough on its own?

Not necessarily. HMRC’s guidance expects procedures to be proportionate to actual risk and reviewed regularly. A policy that was drafted once, isn’t backed by senior-level commitment, and hasn’t been revisited is unlikely to meet the standard the defence requires.

Is this the same as the “failure to prevent fraud” offence?

No. The Corporate Criminal Offence under the Criminal Finances Act 2017 deals specifically with the facilitation of tax evasion. A separate offence, failure to prevent fraud, was introduced under the Economic Crime and Corporate Transparency Act 2023. It deals with fraud more broadly and only applies to large organisations meeting specific size thresholds. The CCO has no such threshold. The two are related in structure but distinct in scope. A business can be in scope for one without being in scope for the other.

Does the CCO apply if my business is based outside the UK?

It can. The offence applies where there’s a UK nexus, so a UK connection can bring an overseas-based business into scope even if it has no other UK presence.

About the author

Shreya Randev is a Corporate Tax Manager at Sedulo Tax.