DMCCA Consumer Enforcement: What UK Boards Must Govern in 2026

The Digital Markets, Competition and Consumers Act 2024 (DMCCA) consumer protection regime is now live — and the Competition and Markets Authority can impose penalties of up to 10% of global annual turnover on companies and up to £300,000 on individuals, without going to court.

What Has the DMCCA Consumer Regime Changed — and When Did It Take Effect?

The DMCCA consumer protection provisions came into force on 6 April 2025, giving the CMA direct administrative enforcement powers over consumer law for the first time. Previously, the CMA had to go through courts to enforce consumer protection rules. Now it acts directly — with the ability to conduct investigations, issue compliance directions, impose fines, and require businesses to make payments to consumers who have been harmed.

Subscription contract obligations are the next major compliance milestone. According to Deloitte’s 2026 analysis of the DMCCA, new rules on subscription contracts — covering renewal notifications, easy cancellation mechanisms, and cooling-off periods — are expected to commence in Spring 2026. Any UK business offering recurring digital subscriptions, software licences, or service contracts should treat this as an immediate board-level review obligation.

The Act also introduces a prohibition on fake reviews — businesses that commission, host, or facilitate fake reviews face direct CMA enforcement action. And the drip pricing rules, already in force, require businesses to include mandatory fees and charges in the headline price shown to consumers from the outset of any purchasing journey.

Executive Action:

• Commission a cross-functional DMCCA compliance audit covering subscription terms, pricing presentation, and online review processes — the CMA has signalled it will act on substantive non-compliance rather than waiting for complaints.
• Brief the board on the shift from court-based to administrative CMA enforcement — directors who were comfortable with the previous regime need to understand the enforcement speed and severity has fundamentally changed.
• Review all subscription contracts for compliance with incoming renewal notification, cancellation, and cooling-off requirements before the Spring 2026 commencement date.

What Does Personal Director Liability Under the DMCCA Actually Mean?

The DMCCA enables the CMA to impose penalties of up to £300,000 on individuals — meaning directors and senior managers — where they have consented to, connived at, or been negligent in relation to a company’s non-compliance. This is not a theoretical risk. The CMA has already demonstrated its willingness to pursue personal accountability in competition enforcement; the DMCCA extends the same logic to consumer law.

Under the Companies Act 2006, directors have a duty to act within their powers and to promote the success of the company. A CMA enforcement action and a £300,000 personal fine would represent a direct failure of that duty. Directors who cannot demonstrate active governance of consumer compliance — through board minutes, internal audit findings, and remediation plans — face exposure not just to regulatory sanction but to shareholder and stakeholder challenge.

The board should formally designate a Consumer Compliance Owner at executive level — typically the CEO or Chief Commercial Officer — who is responsible for reporting compliance status to the board and for ensuring that the DMCCA obligations are embedded in every customer-facing commercial process.

Executive Action:

• Add DMCCA compliance status as a standing board agenda item, with a quarterly report from the designated Consumer Compliance Owner covering open issues, remediation progress, and CMA intelligence.
• Ensure board minutes document that directors have reviewed and approved the company’s DMCCA compliance programme — this creates the governance audit trail that will be essential in any CMA investigation.
• Brief directors individually on the personal liability provisions — individual consent or connivance in non-compliance cannot be defended by reference to collective board decisions.

How Should Boards Approach the CMA’s New Investigation and Enforcement Powers?

The CMA’s administrative enforcement model means it can open an investigation, gather evidence, and reach a provisional decision without a court application. Businesses have the right to make representations, but the CMA sets the timetable. According to Womble Bond Dickinson’s 2024 analysis of the DMCCA, the CMA’s new toolkit represents a step-change in the speed and cost of consumer enforcement — businesses that previously relied on the court process as a natural brake on regulatory action no longer have that buffer.

The DMCCA also strengthens the CMA’s information-gathering powers. It can require businesses to produce documents, provide information, and attend interviews. Non-compliance with an information request is itself a grounds for financial penalty. Boards should ensure their legal and compliance functions have a documented CMA response protocol — including escalation paths, document preservation obligations, and communications strategy — before an investigation begins.

For boards operating across multiple jurisdictions, the DMCCA applies to all businesses targeting UK consumers, regardless of where the company is incorporated. UK-facing digital businesses headquartered in the EU or US cannot assume the DMCCA does not apply to them — and the CMA has shown through its digital markets work that it is willing to act on international businesses.

Boards should review INFORMD’s compliance review templates to structure their DMCCA governance documentation and demonstrate board-level oversight to regulators.

Executive Action:

• Establish a CMA investigation response protocol — covering document preservation, legal privilege, communications management, and board notification thresholds — before it is needed.
• Review whether your international operations include UK-facing consumer products that fall within DMCCA scope, and ensure the compliance programme extends to those business units.
• Test whether your legal and compliance team’s information-gathering capabilities meet CMA request timescales — the CMA will not wait for slow document retrieval processes.

What Are the Board’s Specific Governance Obligations Under the DMCCA?

The DMCCA does not create a standalone board governance obligation equivalent to the UK Corporate Governance Code. But the combination of the Act’s personal liability provisions, the CMA’s administrative enforcement powers, and the FCA Consumer Duty (for financial services boards) creates a governance framework in which boards that have not actively overseen consumer compliance face material risk.

For UK-listed companies, the UK Corporate Governance Code requires the board to maintain sound risk management and internal controls — and the emerging CMA enforcement environment makes consumer compliance a material risk that must be formally managed. The FRC will take note if DMCCA enforcement actions reveal that boards failed to govern consumer compliance risks that were reasonably foreseeable.

According to Osborne Clarke’s analysis of the DMCCA regime, senior management should conduct a thorough review of online selling practices and address unfair commercial practices as a priority. The board should receive the output of that review and formally approve the resulting compliance programme — not delegate it entirely to the legal function without board visibility.

Executive Action:

• Commission a board-level DMCCA risk assessment that maps the company’s consumer-facing practices against the Act’s requirements and identifies material gaps requiring board approval to remediate.
• Ensure your annual governance statement explicitly addresses consumer compliance risk management — the FRC and institutional investors will increasingly scrutinise this dimension of board oversight.
• Liaise with your legal advisers on whether your business’s pricing, subscription, or review practices have any features that would attract CMA scrutiny under the new regime.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.