The General Data Protection Regulation (GDPR) is distracting some companies from focusing on the Criminal Finances Act, which comes into effect at the end of this month and could have serious consequences for those companies that are unprepared, according to analysis by recruitment company 6CATS International. The company's CEO Michelle Reilly said she has seen relatively few companies put proper processes in place to prepare for the Criminal Finances Act, which she said is “highly concerning”.

Reilly said: “The potential punishments include an unlimited fine, reputational damage, the withdrawing of licenses by regulators and even prison sentences in the most extreme cases. We’re urging firms to ensure that they’re fully prepared for what will be a much more risky environment for them to operate within. That means it’s crucial to communicate to your workforce the intricacies of the legislation and educate them on how to remain compliant.”

What is the Criminal Finances Act?

The law becomes effective on 30 September and will create two new corporate criminal offences related to facilitating tax evasion. They are:

1. failure of a relevant corporate body to prevent the facilitation of UK tax evasion by an associated person; and
2. failure of a relevant corporate body to prevent the facilitation of non-UK tax evasion by an associated person.

In other words, companies that facilitate or fail to prevent tax evasion by an employee (or other 'associated person' such as a supplier), either under UK or non-UK tax laws, are liable to prosecution for the crime of 'corporate criminal offences' under the Criminal Finances Act.

Companies that are found guilty of one of these offences could face fines and sanctions, as outlined in this post by PwC: “If a relevant body is successfully prosecuted they will face an unlimited fine and possible ancillary sanctions, such as confiscation or serious crime prevention orders in addition to suffering serious reputational damage. They also risk losing their licences and may be prohibited from bidding for public contracts.”

Six actions to ensure compliance with Criminal Finances Act

Under the Act, companies are liable but they are able to claim 'reasonable procedures defence' if they are able to demonstrate that adequate steps were taken to prevent the tax evasion. PwC highlights the following six principles that should help corporates protect themselves:

1. Carrying out a risk assessment to identify the specific risks of facilitation.
2. Implementing procedures that are proportionate to the specific risks identified in the risk assessment.
3. Performing due diligence of staff, third parties and clients in proportion to the risks that they pose to the business.
4. Ensuring that there is a top level commitment within the organisation to preventing the facilitation of tax evasion.
5. Communication (including training) to employees and third parties to ensure procedures are embedded and understood.
6. Carrying out ongoing monitoring and review of procedures and risk assessment.