Criminal Finances Act coming into force 30th September

Tax evasion

On 30th September 2017, the Criminal Finances Act comes into force, as does the requirement for businesses to have reasonable procedures to prevent the facilitation of tax evasion. The law is broad and the net is wide; a business can be prosecuted if a contractor puts a client in touch with a dodgy accountant or the entire modus operandi of the business is to stash away taxable cash.

VinciWorks conducted a survey of 250 UK businesses to find out just how much tax evasion risk companies are exposing themselves to. A quarter of companies still do not have any policies in place to prevent financial crime and one in ten companies in the legal and financial services sector haven’t put in place a whistleblowing policy.

Over a third of companies haven’t started recording financial crime breaches, and when it comes to satisfying regulators, or a judge, that reasonable procedures are in place to prevent criminal facilitation, the majority still believe they are lacking. At least 75% of companies, including half of financial services and law firms, believe that many of their colleagues are completely unaware of the laws and offences around tax evasion.

Criminal facilitation can occur even without knowledge of the business. If an employee or contractor is helping facilitate tax evasion, then the business can be prosecuted if they fail to have reasonable procedures in place to prevent it.

Implementing reasonable procedures is a key defense against prosecution. But creating those procedures requires a thorough risk assessment, a top-down commitment, and a roll out of staff training.

Guidance from HM Revenue and Customs says procedures that successfully detect and disclose wrongdoing would likely be reasonable. Timely self-reporting is also an indicator that reasonable procedures are in place.

The new law does not require burdensome procedures designed to perfectly address every conceivable risk. Rather, a company should document policies and procedures and allocate resources that are proportionate to its risk profile. Not every company has to implement new procedures as a result of a risk assessment. If the tax evasion risk profile remains very low or existing policies could catch it, then a company can decide not to implement new reasonable procedures. However, this must be evidenced and backed up with an ongoing risk assessment process should circumstances change. Corporates may have even more reason to be concerned as most regulated sector businesses already have clear procedures in place around financial crime.

Training for everyone in an organization on the Criminal Finances Act, including how to spot the signs of facilitation and what to do about it, are essential. That training can contribute significantly to a set of proportional, reasonable procedures that will help tackle tax evasion and protect the organization and its people from prosecution.

Free tools to help your organisation stay compliant

VinciWorks has published a free short document with key guidelines to creating a tax evasion policy. We also provide a fully customisable tax evasion e-learning course. The course is available as both a 15 minute or a 45 minute version, with another course available specifically for the corporate sector. These online courses include completion tracking and reporting in order to demonstrate to HMRC that a training programme is in place.

Our risk team can help you prepare for the Act coming into force. As part of a three stage approach, we:

  • Assess the probable impact of the new corporate criminal offences to your business
  • Conduct a risk assessment of your business to determine areas of exposure and vulnerability
  • Assist with the implementation of a remediating and enhancing risk management plan

Contact us using the form below to discuss your risk exposure and which steps you should take to ensure you remain compliant.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.