Need to know for non-executive directors and senior management
Welcome to the spring issue of Boardroom Essential, our regular publication for non-executive directors and senior management.
Click on the titles below to jump to the topic you would like to read.
FAILURE TO PREVENT FRAUD: THE NEW CORPORATE OFFENCE COMING INTO EFFECT IN SEPTEMBER
In November 2024, the UK government published long-awaited Guidance on the new corporate offence of failure to prevent fraud. This represents a pivotal move towards holding organisations more readily accountable in the UK for economic crimes, and at the same time marks a major development in compliance expectations.
Set to take effect from 1 September 2025, the new offence means that large organisations may be criminally liable if an “associated person”, such as an employee or a subsidiary, commits fraud intended to benefit the organisation, its customers or its clients. However, it will be a complete defence if an organisation can prove reasonable fraud prevention procedures were in place – emphasising the critical role of governance and compliance frameworks.
The Guidance offers practical advice for organisations on designing and implementing fraud prevention procedures, building upon established principles from prior failure-to-prevent offences such as those relating to bribery. However, the new Guidance reflects a more refined and comprehensive approach, reflecting over a decade of enforcement experience of what constitutes “adequate” or “reasonable” compliance programmes. The Guidance also encourages businesses to draw on a broad array of resources, including the UK Corporate Governance Code.
What should organisations do now?
If they have not already started doing so, organisations must act swiftly to ensure reasonable fraud prevention procedures are in place before the new offence takes effect on 1 September 2025. Although the government has allowed for a ten-month lead time, which may seem generous, the timetable remains challenging, particularly for large businesses with numerous interested stakeholders.
The new Guidance sets out clear, actionable expectations for fraud prevention procedures. The first step should be to carry out a comprehensive risk assessment to identify the unique fraud risks specific to the business and its sector. This includes understanding who the business’ “associated persons” are and what might drive them to commit fraud. This risk assessment is the foundation of any effective fraud prevention compliance framework.
Once these risks are identified, tailored policies and procedures should be implemented to address them, followed by communication and training to embed these practices across the business. All these measures need to be in place by 1 September 2025 to maximise their protective effect and any organisations that have not completed their risk assessments should progress these as soon as possible.
Additionally, it is important to fully document the steps taken in response to the Guidance, including the considerations and decisions made in relation to enhancements to pre-existing policies and procedures. This documentation will serve as crucial evidence if an organisation ever needs to rely on the defence of having reasonable fraud prevention procedures in place.
RANSOMWARE: WILL YOU HAVE TO REPORT PAYING A RANSOM? NEW UK RULES PROPOSED
Amid the range of cyber-related legislation affecting organisations’ decision making and governance, the new “world leading” proposals from the UK’s Home Office stand out. As proposed, organisations will need to report if they are considering paying a ransomware demand and may be banned from paying altogether.
Ransomware is cited as a key risk for many organisations, and many think that it’s ‘when not if’ in terms of having to manage a ransomware incident.
We regularly speak to clients about their approach to ransomware payments and the factors to consider – ideally as part of their cyber preparedness work but sometimes (unfortunately) in the heat of helping them respond to an attack. Both handling and preparing for an attack may be very different if the proposals in the consultation become law.
The three legislative proposals under consultation are:
-
A targeted ban on ransomware payments for all public sector bodies, including local government, and for owners and operators of Critical National Infrastructure (‘CNI’) that are regulated (building on the current ban for central government departments). Ransomware gangs want to get paid and the aim is to make the UK and its essential infrastructure an unattractive target to those gangs. One obvious question then becomes, won’t the gangs then just move down the supply chain? The Home Office is therefore seeking views on whether essential suppliers to these sectors should also be included in the new rules. In terms of enforcement, the Government is seeking an effective but proportionate solution to encourage compliance. The consultation discusses a range of possible measures, from making non-compliance with the ban a criminal offence to corporate and personal civil penalties, including monetary penalties or disqualification.
-
A new ransomware payment prevention regime which would require any ransomware victim (those not covered by the ban mentioned above) to engage with the authorities and report their intention to make a ransomware payment before paying money to the cyber criminals. They would then receive support and guidance, and the authorities would review the proposed payment to see if there is a reason to block it (e.g. sanctions issues). How this will work in practice remains very uncertain. For example, can the necessary checks be concluded within the necessarily tight timeframes, how will organisations engage without waiving privilege or compromising future claims risk, and what if the authorities get it wrong?
-
A ransomware incident reporting regime which would apply to victims of a ransomware attack, regardless of their intention to pay. The Home Office is currently exploring who would need to report - for example, should the reporting requirement be economy-wide, or only impact organisations and individuals meeting a certain threshold, and indeed should individuals be excluded? Recognising the multiplicity of incident reporting at the moment, the Home Office promises to work with other Government Departments “to consider the deconfliction of reporting requirements during the development of any legislation.” The proposal envisages both an initial report to relevant parts of the Government within 72 hours, and a fuller report within 28 days.
Comment:
The UK Government has made it clear for some time now that it does not approve of organisations paying ransoms, and wants to disrupt the cyber criminals and their business model. It has sanctioned some cyber criminals and is an active member of the Counter Ransomware Initiative (CRI). As part of its work with the CRI, the UK signed a joint statement against ransomware payments back in November 2023. The statement confirmed, for the first time, that no central government funds should be used to pay ransomware demands. ICO enforcement is also clear there is no ‘credit’ for paying ransoms. These latest proposals go a step further, extending the ban and introducing separate notification obligations in relation to suffering an attack, and making a ransomware payment. The proposals arguably reflect public sentiment, as the consultation document references Home Office polling which found that 68% of the public believed that it is wrong for a business to pay a ransom because that ransom could be used by attackers to fund more criminal activities, and 81% believed a business should report a ransomware attack, even if they can resolve it on their own.
The Home Office is clear that the status quo cannot continue but the proposals are at a very early stage and raise significant questions. Even accepting the premise that cyber-crime should not pay, much more will be needed to make these proposals effective at an operational level and avoid increasing uncertainty (and cost) for businesses. In any event, the risk of criminal sanctions and/or board disqualification in these proposals should be read alongside the responsibility and liability for management bodies in the EU’s NIS2 Directive (which could even be mirrored in the UK’s equivalent Cyber Security and Resilience Bill) and more well-established duties when preparing for an attack. Both of these may lead to organisations structuring groups and their operations to manage obligations on a jurisdiction by jurisdiction basis.
PRESIDENT TRUMP REWRITES RULES ON TAX AND TRADE: HOW COULD THE UK BE AFFECTED?
On 4 March 2025, President Trump told Congress that his Administration “accomplished more in 43 days than most administrations accomplished in four years or eight years, and we are just getting started.” Tax and trade is one area where a lot has happened since 20 January 2025 with significant consequences for business and markets.
Even if the UK is able to agree a trade deal to escape sweeping tariffs imposed by the US, UK businesses will be affected by any slowdown in global trade and continuing uncertainty. Moreover, there is a real possibility that the US will impose tariffs and/or other punitive measures on UK businesses in response to UK tax measures that are considered discriminatory or extraterritorial.
Tariffs and trade
Barriers placed by the US on trade with the UK would significantly impact UK business as the US is the UK’s largest trading partner (or the second largest after the EU, if one looks at the total value of trade between the UK and all EU Member States combined). Initially, it seemed that the UK was not on Trump’s tariff radar as the US trade deficit with the UK is negligible but there is considerable uncertainty about whether US tariffs could be applied to some UK goods. Although President Trump has also signalled willingness to negotiate a trade deal with the UK, even if this is agreed, it may be limited to the technology sector.
Also of concern, from a UK perspective, are potential retaliatory measures for taxes perceived to be discriminatory or extraterritorial. The White House’s reciprocal trade and tariff memorandum refers to value added tax (VAT) as an example of “non-reciprocal trade relationships” that may be subject to equalisation measures from 2 April 2025. This is particularly concerning. VAT applies equally to domestic and imported products and is not a trade measure. Treating it as such is contrary to established norms and likely to be particularly complex and costly – for the UK, the EU and many other countries that impose similar taxes.
Other UK tax measures could attract US retaliation
Import VAT is not the only UK tax measure that could provoke US retaliatory action. Other likely candidates include the UK’s digital services tax and diverted profits tax, and elements of the UK’s implementation of the OECD-brokered agreement on the global minimum tax that President Trump renounced on his Inauguration Day:
-
Digital Services Tax (DST) is a 2% tax on revenues of search engines, social media platforms and online marketplaces which derive value from UK users. Tax receipts are forecast to be around £1 billion per year.
-
Diverted Profits Tax (DPT) is a punitive tax charge at a rate of 31% (six percentage points above the UK’s main corporation tax rate) imposed on income deemed to have been artificially diverted from the UK. Annual DPT receipts have fluctuated between £219 million and £12 million, as disputes where DPT is relevant tend to be settled through higher corporation tax (rather than DPT) payments. Additional corporation tax receipts from DPT investigations have decreased over time as business restructured, and it has been argued that DPT is rife for abolition as it has largely achieved its aim.
-
The element of the global minimum tax that has attracted particular US ire is called the “Undertaxed Profits Rule” (UTPR) which would, in certain circumstances, allow the UK to impose tax, for example, on a UK subsidiary of a US group by reference to undertaxed income in respect of sister and parent companies in other jurisdictions (although transitional provisions would prevent a charge in respect of undertaxed US income for a limited period). UK revenues from the UTPR have been forecast at a few £100 million per year.
It is likely that the UK government will wait for further information on potential retaliatory measures before deciding the future of these measures. The revenue shortfall from their abolition should be relatively small (less than £2 billion) but may be difficult to plug in an already challenging fiscal climate.
And these are only the most prominent current tax policy examples. Another measure that could provoke a US reaction may be the planned business rates reform to the extent that it aims to (quoting the Labour Party’s manifesto) “level the playing field between the high street and online giants” which are predominantly based in the US.
What could US retaliation look like?
In addition to tariffs that were already proposed following an investigation by the US Trade Representative into the UK’s digital services tax during the first Trump Administration, retaliatory measures could include invoking a provision to double certain US taxes on UK businesses, for instance on US branch profits. Under draft legislation proposed by Republican lawmakers, UK businesses could suffer withholding tax on payments (including interest and dividends) of up to 50 per cent. and restrictions on public procurement. The draft legislation envisages that these punitive withholding tax rates would apply irrespective of any provision for lower rates in the UK/US double tax treaty.
DEMERGERS: UNLOCKING VALUE
Demergers are among the most complex and high-opportunity transactions a company can undertake. Whether to realign focus on core business operations, increase profitability or satisfy shareholders, demergers require strategic precision. As M&A activity intensifies, we anticipate strategic M&A continuing through separations, divestitures, split-offs and spin-offs globally.
This article explores the key issues and market considerations essential for delivering a successful demerger.
Additionally, we share insights from our recent experiences helping some of the world’s most recognised brands unlock significant value from their portfolios across EMEA, APAC and the Americas.
'ALL CHANGE' FOR CONSUMER PROTECTION: WHAT YOU NEED TO KNOW
Recent years have seen consumer protection propelled to the top of the agenda for policymakers and regulators. On 6 April 2025, long-awaited reforms under the Digital Markets, Competition and Consumers Act (DMCC Act) will overhaul the UK consumer law regime and increase the stakes for non-complying businesses. There are also clear signs of more action to come in this area at the EU level, as the new European Commission gears up for its upcoming 2025-2030 Consumer Agenda.
In 2025, consumer-facing businesses operating in the UK and EU should prepare for increased public and private enforcement of consumer protection rules, particularly on hot topics such as greenwashing and online choice architecture.
Consumer law enforcement – the new antitrust?
This April, the UK Competition and Markets Authority (CMA) will see its investigation and enforcement toolkit bolstered by the DMCC Act. For the first time, the CMA will gain the power to issue infringement decisions for consumer law breaches and directly impose fines of up to 10% of a business’ global turnover, bringing the regime more closely in line with the CMA’s existing antitrust enforcement regime. Currently the CMA can only accept undertakings from a company under investigation or otherwise apply to court to seek an enforcement order.
The magnitude of the fines issued by the CMA, and whether they will match the levels we have seen in antitrust cases, remains to be seen. So far, the fining guidance published by the CMA signals that it intends to replicate some aspects of its approach in Competition Act cases, such as taking account of aggravating factors and the availability of settlement discounts. The introduction of potentially large financial penalties should act as a significant deterrent for non-compliance.
The CMA has already stated that it is “carefully considering and preparing for [its] first cases” under its new enforcement arsenal. We expect the CMA will start implementing its blueprint for these investigations in the coming year, as set out in its new Guidance on direct consumer law enforcement. Over time, we will likely see the courts scrutinising the CMA’s application of its new fining powers. Looking beyond the CMA’s remit as the main consumer protection authority, the current UK focus on consumers has also materialised through several sectoral reforms and initiatives, including the Financial Conduct Authority’s (FCA) Consumer Duty, which came into force across 2023-2024 and for which we still await the first test cases.
These UK reforms are in line with EU trends towards enhanced enforcement. We are continuing to see consumer organisations submitting pan-European complaints to the EU Consumer Protection Cooperation (CPC) network, a cross-jurisdiction mechanism aimed at streamlining consumer enforcement via coordinated action in the EU. The CPC network, coordinated by the European Commission, is also proactively conducting consumer law “compliance sweeps”. The new Commissioner in charge of the EU consumer protection portfolio, Michael McGrath, has signalled his intention to propose further enhancements to the Commission’s role in enforcing consumer laws across the EU.
All eyes on greenwashing, “dark patterns” and essential spending
Recent years have seen a marked uptick in enforcement action related to companies’ environmental claims. We can expect greenwashing to remain a key area of focus for consumer protection authorities. To date, the UK has not introduced any cross-sectoral legislation targeting greenwashing specifically. However, alongside pursuing enforcement action, the CMA has been highly active in publishing a Green Claims Code and sector-specific guidance. The FCA also introduced an anti-greenwashing rule for financial services firms in May 2024. In the EU, the Directive on Empowering Consumers in the Green Transition was adopted in March 2024, while the proposed Directive on Green Claims is progressing through the legislative process. Companies should ensure they stay informed of developments in this area, including any emerging regulatory divergence.
This year, the CMA and other consumer law enforcers will likely continue to grapple with consumer harms linked to online choice architecture and so-called “dark patterns”, such as “drip pricing” practices and misleading scarcity or popularity claims. To facilitate enforcement in this area, the package of UK reforms in the DMCC Act modernises existing consumer rights and creates novel areas of protection for the digital age. This includes, for example, new rules on fake reviews and subscription traps, with the latter being subject to transitional arrangements. At the EU level, the European Commission has recently signalled appetite to address similar policy concerns, with suggestions of a proposal for an EU Digital Fairness Act. Authorities are also expected to be vigilant of any consumer protection threats that may derive from the deployment of AI technology.
Considering cost-of-living constraints, we can also expect enforcement to focus on areas of essential spending and where consumers are under particular financial pressure, such as housing and accommodation, transport, groceries and everyday household items.
Consumer law and competition litigation: are the blurred boundaries here to stay?
In the past few years, mass competition damages claims have continued to gain momentum in the UK, including on a “standalone basis” where there is no prior enforcement decision by a regulator. However, the UK’s opt-out collective proceedings regime is not currently available in respect of consumer law breaches. The attractiveness of this regime has led claimants to seek to push the boundaries of what qualifies as a breach of competition law, with a view to bringing high-value claims on an opt-out basis (for example, characterising consumer law issues as an abuse of dominance). We expect this trend to continue this year.
There have already been calls by some to extend the UK’s collective proceedings regime to cover consumer law breaches, in addition to competition law, due to the disconnect between the respective public enforcement and private enforcement models. A proposal to do so was ultimately excluded from the final version of the DMCC Act despite being raised during the bill’s reading. It remains to be seen whether the Labour government will revive this proposal in 2025 (or beyond).
At the EU level, many Member States are completing their implementation of the EU Directive on Representative Actions. This will pave the way for more collective consumer claims across the EU. The Directive leaves it at the discretion of Member States to provide for opt-in or opt-out mechanisms, or a combination of both, with some Member States adopting enhanced consumer redress regimes going beyond the minimum standards set out in the Directive (so-called “goldplating”).
Consumer-facing businesses operating in the UK and the EU should carefully monitor this emerging stream of potential mass consumer claims, as their outcomes could incentivise claimants to bring ever-larger and (in the case of the UK) more creative claims – increasing litigation risk for businesses.
If you would like more information on any of the matters covered, please speak to your usual Slaughter and May contact.
This material is provided for general information only. It does not constitute legal or other professional advice.