The Criminal Finances Act 2017 and HMRC's new approach to its Business Risk Review

The introduction of the new corporate criminal offences of failing to prevent the facilitation of tax evasion (the "Offences"), which were introduced by Part 3 of the Criminal Finances Act 2017 (the “Act”) and came into force on 30 September 2017, is one such measure. 

Under the Act, a corporate body or partnership (“relevant body”), may be criminally liable where it fails to prevent its employees or associated persons from criminally facilitating tax evasion. There is no requirement that the tax evaded is UK tax and both Offences are strict liability offences. This means that a relevant body will be guilty if any of their associated persons criminally facilitate the evasion of tax. The only defence available is for a relevant body to demonstrate that it had "reasonable preventative procedures" in place.

The Government has provided a great deal of guidance to businesses explaining how to comply with the new measures. Yet, there still appears to be lack of engagement on the issue in business as a whole.

HMRC Research Study

In March 2019, HMRC published the results of a research study into the impact of the Offences.

The Offences were designed to drive a behavioural shift among businesses by placing a responsibility on them to take active steps to prevent the facilitation of tax evasion. It is understood that the purpose of the study was to measure how successful the Offences have been in achieving HMRC's desired goal.
HMRC explain in their report that:

"In order to meet the research objectives, the research focused on a representative sample of UK companies and partnerships across all sectors of the economy, according to the Office for National Statistics’ Standard Industrial Classification, and were combined for analysis where base sizes were too low to be looked at independently."

The relevant information was gathered by conducting a random telephone survey of 1,002 businesses between 13 August and 28 September 2018.
The key findings of the study can be summarised as follows:

• 74% of the businesses surveyed claimed to be unaware of the Act and of those who were aware, only around one third thought it was relevant to their business;
• large businesses and those in the financial services and insurance sector are much more likely to have taken action;
• 64% of businesses had not yet made any changes to their operations as a result of the Act;
• 55% of businesses said they had at least one of the expected six prevention procedures in place; and
• 26% said they intended to make changes in the next 12 months.

In their conclusions, HMRC note that UK businesses appear to have a "relatively low" level of awareness of the Offences. Given these conclusions, we would expect to see an increase in activity from HMRC in this area over the coming months as they seek to raise awareness. However, businesses should remember that it is their responsibility, not HMRC's, to take active steps to prevent the facilitation of tax evasion.

Active Steps

The "active steps" that HMRC had expected businesses to take was the development of "reasonable preventative procedures", which if designed properly should provide a business with a defence to the Offences. In its guidance, HMRC explained that when designing its "reasonable preventative procedures" a business should have regard to the following six principles:

1. Risk assessment: Businesses should identify the nature and extent of the risk that their associated persons are criminally facilitating tax evasion. The risk assessment should be documented and kept under review.
2. Proportionality: The preventative procedures will need to be proportionate to the risk the business faces, which will depend on the nature, scale and complexity of its activities. Businesses are not required to have to undertake excessive due diligence but they will have to show that they have paid more than just “mere lip service” to preventing the facilitation of tax evasion.
3. Top-level commitment: Businesses must be able to demonstate that top-level management is committed to preventing persons associated with the business from engaging in criminal facilitation of tax evasion.
4. Due diligence: Businesses should apply a risk-based approach to due diligence on their associated persons in order to mitigate the identified risks.
5. Communication: Businesses should seek to ensure that their preventative policies and procedures are embedded and understood throughout the organisation, through internal and external communication, including training.
6. Monitor and review: Businesses should monitor and review their preventative procedures and make improvements where necessary.

HMRC indicated in its guidance that the preventative procedures that are considered reasonable will change as time passes. However, HMRC was also very clear to emphasize that there would be no "grace period" following the Offences coming into force and that as of 30 September 2017 it would expect all businesses to have completed the following as minimum:

• demonstrated top-level commitment;
• conducted an inherent risk assessment; and
• developed an implementation period plan.

It has now been over 18 months since the Offences came into force and HMRC is now seriously looking into what active steps businesses have taken.

Why is it important for business to act now?

Increased activity by HMRC

In response to a Freedom of Information Act Request submitted by Law Firm Greenberg Traurig, it was confirmed that:

"… HMRC currently has less than five criminal investigations into behaviours occurring since 30 September 2017 for an offence under section 45 of the Criminal Finances Act".

The above quote confirms that HMRC has already commenced criminal investigations into relevant bodies suspected of failing to prevent the facilitation of tax evasion. We expect HMRC’s activities to significantly increase in this area as it seeks to raise awareness and to engineer the hoped for behavioural shift. In addition, as part of the new approach to conducting business risk reviews, HMRC will be scrutinising what active steps have been taken by relevant bodies to prevent the facilitation of tax evasion.

HMRC's Business Risk Review

Following a public consultation in March 2018, HMRC has recently confirmed that it will be shortly signing off on its new Business Risk Review (the "BRR"). Businesses will become subject to a risk assessment by HMRC.

The two eye-catching features of the BRR are, firstly, the introduction of four levels of risk with a separate rating for each tax regime (i.e. VAT, Corporation tax, PAYE, etc). The four risk ratings are:

• low risk;
• moderate risk;
• moderate – high risk; and
• high risk.

Secondly, the rating that a business receives will be based on the following three behavioural factors:

• approach to compliance;
• internal governance; and
• systems delivery.

Each of the behavioural factors contains a number of low-risk indicators that will be assessed by the relevant specialists within HMRC as part of the business review. Only if a business meets all of the low-risk indicators will HMRC classify them as low risk.

HMRC have specifically explained that a failure to address the Offences will be an indicator of higher risk for tax governance and therefore a business will not be classified as low risk.

HMRC will be checking what steps businesses have taken to address the Offences as part of their proposed new Business Risk Review that is expected to be rolled out in October 2019. If a business is unable to show that it has taken active steps, it its likely to receive a "high risk" rating.

HMRC have not specifically stated the disadvantages of being classified as high risk, but clearly high risk businesses will be more likely subject to control visits and increased scrutiny from HMRC.

Consequences for failing to take active steps

As the Offences carry strict liability, relevant bodies will be automatically guilty unless they can prove that they have taken active steps to implement and maintain reasonable procedures to prevent the facilitation of tax evasion. As well as facing an unlimited fine, a business found guilty of one of the Offences could find itself subject to ancillary orders such as confiscation orders and serious crime prevention orders. Directors may also be personally disqualified and in addition, a public conviction would carry obvious reputational implications.

Given the almost certain increase in activity by HMRC in this area and the potential sentences that could be imposed, it is essential that businesses complete the active steps expected by HMRC as soon as possible. The longer businesses ignore their obligations created by the Offences, the greater the risk of being caught cold.

What you need to do now

As a minimum, HMRC expect all businesses to have performed the following steps:

• demonstrated top-level commitment;
• conducted an inherent risk assessment; and
• developed an implementation period plan.

If you are a business that is yet to address its obligations in relation to the Offences or feels that further work is required to improve your compliance, you should act immediately in order to mitigate your potential exposure. Any failure to comply will have self-evident consequences in terms of relationships with HMRC and could be devastating should one of your associated persons facilitate tax evasion.

For further information on how we can help please contact us.