CMA Direct Fines Are Here: A UK Board DMCC Compliance Guide
The Competition and Markets Authority can now fine UK companies up to 10% of global turnover for consumer law breaches, without going to court, under the Digital Markets, Competition and Consumers Act 2024 (DMCC Act).
That power took effect on 6 April 2025 and has moved from theory to invoice. The CMA has issued its first penalties, and boards that treat consumer law as a marketing-team matter are carrying unpriced risk. This guide sets out what changed, what the early cases teach, and what to ask management. It sits alongside our briefings on director personal liability and the failure to prevent fraud offence.
What changed under the DMCC Act, and why does it reach the boardroom?
Before 2025, the CMA had to persuade a court that a business had broken consumer protection rules. It now decides breaches itself, imposes fines, and orders redress. Maximum penalties are 10% of global annual turnover, or £300,000 if higher, and up to £300,000 for individuals in some circumstances, such as obstructing an investigation.
The Act also bans specified practices outright, including fake reviews and hidden mandatory fees (drip pricing), and requires businesses to treat pricing and choice design as legal matters rather than conversion tactics. Parent companies that control consumer-facing subsidiaries can be held liable.
According to law firm Mayer Brown’s August 2026 review, the CMA opened 14 investigations in the regime’s first year and issued 157 advisory or warning letters. Its stated position: “we’re just getting started.”
Executive Action
- Add DMCC Act exposure to the risk register with a quantified worst case tied to group, not subsidiary, turnover.
- Confirm which committee owns consumer law compliance; if the answer is “nobody”, assign it to the Risk or Audit Committee this quarter.
- Ask the general counsel for a one-page map of every customer-facing channel in scope.
What do the CMA’s first fines tell us about enforcement priorities?
The first penalty, announced on 15 April 2026, was £4.2 million against AA Driving School and BSM for drip pricing: a £3 booking fee excluded from headline prices and revealed only at checkout. According to Lewis Silkin, the initial penalty of £7 million (roughly 0.5% of the AA’s turnover) was cut by 40% for early settlement, and more than £760,000 in refunds went to over 80,000 customers.
Other decisions followed. According to Mayer Brown, Marks Electrical was fined £720,000 for default opt-ins, StubHub £889,000 for hidden fees, and Euro Car Parks £473,000 for failing to comply with an information notice. Every settled case received a 40% reduction, and prior regulatory findings aggravated penalties.
Two lessons matter for directors. The fines are modest against turnover so far, but small consumer charges multiplied across many transactions create large refund liabilities. And a low-value breach is enough: a £3 fee triggered a £4.2 million outcome. The CMA is signalling that scale of harm, not sophistication of scheme, drives action.
Executive Action
- Commission a pricing transparency audit across web, app, phone and partner channels, covering every mandatory fee.
- Quantify refund exposure: fee value multiplied by transactions since 6 April 2025.
- Decide in advance your settlement posture; the 40% discount requires admitting liability.
Which commercial practices carry the highest risk?
The CMA has named its focus areas: drip pricing, fake reviews, online choice architecture (countdown timers, pre-selected boxes, scarcity messages), unfair contract terms and subscription practices. Each is typically owned by commercial, product or marketing teams that rarely report to the board on legal risk.
Fake reviews deserve particular attention where firms rely on third-party review platforms or incentivise feedback. Businesses must take reasonable steps to prevent and remove misleading reviews, and cannot delegate accountability to an agency. Online journeys designed by growth teams to lift conversion are the most likely source of a first investigation.
Executive Action
- Ask for a register of every pre-selected option, urgency message and headline price claim in customer journeys.
- Require legal sign-off for changes to pricing display and checkout flows.
- Review contracts with review platforms and affiliates for compliance obligations and audit rights.
How should the board evidence oversight?
Directors are not personally liable for every corporate breach, but the CMA weighs compliance culture when setting penalties, and courts and regulators expect documented challenge. The strongest position combines a clear owner, management information reaching the board at least twice a year, and records showing that concerns were escalated and acted on.
Practical management information includes complaint themes, refund volumes, CMA correspondence, results of pricing audits and the status of any information notices, which the CMA fined Euro Car Parks for mishandling. Treat an information notice as a board-visible event with a named responder and a deadline.
Executive Action
- Add a consumer compliance dashboard to the Risk Committee pack.
- Set an escalation rule: any CMA contact reaches the chair within 48 hours.
- Test readiness with a tabletop exercise using our assessment tools and templates.
Frequently asked questions
Up to 10% of global annual turnover, or £300,000 if higher, for breaches of consumer protection law. The CMA can also order refunds. Fines can be reduced, currently by 40% in settled cases, where the business admits liability and cooperates early in the investigation.
The consumer provisions protect individual consumers, so purely business-to-business sales are largely outside them. However, firms that sell to consumers through any channel, or supply consumer-facing partners, are in scope, and unfair terms and pricing rules still affect mixed customer bases.
Drip pricing means advertising a headline price and adding mandatory fees later in the buying process. Under the DMCC Act, unavoidable charges must be included in the price shown upfront. The AA’s £3 booking fee, revealed only at checkout, led to a £4.2 million penalty.
Yes. The CMA has indicated that parent companies controlling consumer-facing subsidiaries can be held liable, with penalties calculated on group turnover. Boards of holding companies should therefore not assume subsidiary-level compliance failures stay contained within the operating entity.
About INFORMD
INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools. Questions? Contact us.
Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.
