The Corporate Criminal Offences under the CFA 2017
The CFA 2017 introduced two corporate criminal offences ("CCOs"):
- the failure to prevent the facilitation of UK tax evasion (section 45); and
- the failure to prevent the facilitation of overseas tax evasion (section 46).
These offences are strict liability in nature, meaning that a corporate entity or partnership can be held criminally responsible if an "associated person" (such as an employee or contractor) facilitates tax evasion while providing services for or on behalf of the business – even if the business itself was unaware of the conduct.
The offences are broad in scope, covering all forms of tax (including income tax, VAT and customs duties) and with section 45 applying to any relevant body, regardless of where it is established. The only available defences are that the business had in place "reasonable prevention procedures" or that it was not reasonable to expect such procedures in the circumstances.
HMRC’s First Prosecution and the Compliance Wake-Up Call
For several years after the CFA 2017 came into force, there were no prosecutions, leading some to question HMRC's ability to meet the evidential hurdles and the Act’s overall effectiveness. It was reported in the summer of 2025 that HMRC secured its first prosecution against an accountancy firm in Stockport.
In addition, HMRC confirmed in the late autumn of 2025 that it had 11 live CFA 2017 investigations, 27 opportunities, and that it has carried out a further 121 reviews, deciding not to proceed to a prosecution.
The prosecution and ongoing investigations serve as a stark reminder that HMRC is prepared to take action under the CFA 2017 and that businesses must ensure their prevention procedures are robust, proportionate, and regularly reviewed. The repercussions of non-compliance can be severe, including unlimited fines, exclusion from public procurement, regulatory proceedings, and significant reputational damage.
Landmark Conviction: Promoting Tax Fraud on Instagram
In parallel with corporate enforcement, HMRC has also secured a landmark conviction against an individual for promoting tax fraud via Instagram. This case involved a social media influencer who used their platform to encourage and instruct followers on how to commit VAT fraud. The individual was prosecuted under the Serious Crime Act 2007 for encouraging or assisting the commission of an indictable offence.
This conviction demonstrates the shift towards pursuing not only those who commit tax fraud or evasion but also those who facilitate or promote it, particularly through digital channels. It sends a clear message: online activity is subject to the same scrutiny as traditional forms of advice, and individuals who use social media to promote tax evasion face real criminal consequences.
This should also be seen in the context of the Government's wider efforts over recent years to close the tax gap and come down hard on non-compliance. Within the last year, the Government has:
- doubled the maximum prison term for tax fraud from seven to 14 years;
- created a new criminal strict liability offence for promoters of tax avoidance;
- introduced a new corporate criminal offence of failure to prevent fraud in the Economic Crime and Corporate Transparency Act 2023 ("ECCTA 2023") which includes the common law offence of cheating the public revenue;
- announced its intention to increase the number of annual charging decisions for the most harmful tax fraud by 20% by 2029–30; and
- announced a £1.4 billion increase to HMRC's budget in the next five years to address non-compliance, which is intended to raise £1 billion per year by 2029-30. RC compliance over the next five years, in addition to recruiting thousands more compliance staff.
The overall messages from the Government are clear – compliance is key and businesses can expect enhanced scrutiny.
What Should Businesses Do Now?
In light of these developments, businesses should review their compliance and prevention procedures for offences under the CFA 2017 and ECCTA 2023. HMRC’s guidance sets out six principles for reasonable prevention procedures:
- Risk assessment
- Proportionality of risk-based procedures
- Top-level commitment
- Due diligence
- Communication and training
- Monitoring and review
- Prevention procedures should be tailored to the size, complexity, and risk profile of the business. Regular training, clear policies, and ongoing monitoring are essential. Businesses should also be aware that compliance with the CFA 2017 is increasingly being considered in HMRC audits and business risk reviews.
