Regulatory investigations on the rise: Is your business prepared?

Over the last 12 months, there has been a noticeable increase in regulatory investigations and enforcement activity across a range of regulators and sectors.

Recent examples include:

• CMA investigations into consumer-facing practices, including Ryanair and StubHub, reflecting the regulator's continued focus on pricing transparency, the presentation of mandatory fees, and charges, and broader consumer protection compliance under the Digital Markets, Competition and Consumers Act 2024 (DMCCA).

• Continued ASA enforcement activity, including recent rulings on the new restrictions applying to less healthy food and drink advertising. Those rulings have provided further clarity on the operation of the regime, including the scope of the brand exemption.

There are also important investigations being launched by sectoral regulators such as the:

• Environment Agency is currently particularly focus on waste crime and water pollution

• Groceries Code Adjudicator's (GCA) is investigating into Amazon

Viewed together, these developments point towards a clear trend: regulators are increasingly willing to use formal investigatory and enforcement powers where they identify potential non-compliance. Importantly, this is not limited to traditionally highly regulated sectors. Consumer-facing businesses may find themselves engaging with a range of regulators, from bodies with economy-wide responsibilities such as the CMA and ASA, to sector-specific regulators with their own enforcement priorities and investigatory powers.

Why prepare now?

For many businesses, the most immediate area of regulatory risk will be consumer-facing activity. Recent CMA investigations and ASA rulings demonstrate the continued focus on matters such as pricing, promotions, advertising and other practices that influence consumer decision-making. These issues can arise across a wide range of sectors, including businesses marketing events, memberships, bookings, food and drink offerings, or other products and services directly to consumers.

However, the recent investigations launched by the GCA and the Pubs Code Adjudicator illustrate a broader point. Regulatory scrutiny is not confined to consumer protection and advertising. Sector regulators continue to monitor compliance actively and are prepared to investigate where concerns arise.

Each regulator has their own investigation procedure, but the common theme is that regulators expect organisations to engage quickly, provide relevant information promptly and demonstrate that appropriate compliance processes are in place. Against that backdrop, businesses should be considering not only whether they are complying with applicable requirements, but also whether they are prepared to respond effectively if regulatory action arrives with little warning and demanding deadlines. As good preparation tends to lead to better outcomes for businesses who are investigated.

Practical steps businesses should consider

• Review your investigation and dawn raid procedures. Businesses should ensure that any investigation response plans and dawn raid policies are up to date and readily accessible. As highlighted by Mills & Reeve's dawn raid team, regulatory inspections can occur with little warning and timing is often critical. Clear procedures can help ensure that individuals understand their responsibilities from the moment a regulator arrives or makes contact.

• Know who you are going to call. When an investigation begins, businesses rarely have the luxury of time. Key internal stakeholders should be identified in advance, including legal, compliance, operational and communications personnel. Businesses should also know which external advisers they would contact if an issue arises particularly for specialist areas. Having trusted "phone-a-friend" advisers identified before they are needed can save valuable time during the early stages of an investigation. Make sure you also keep details of relevant insurance protection to hand.

• Train frontline staff. Reception teams, executive assistants, and operational managers are often the first individuals where traditionally the first to encounter regulators. However increasingly regulators will contact businesses by publicly available email address such are for customer services. Staff members responsible for both customer services and reception teams, executive assistants, and operational managers should be trained on escalation procedures and know who to contact immediately. Mills & Reeve's dawn raid guidance recommends ensuring that support staff, senior executives, and legal teams all understand their respective roles before regulatory engagement occurs.

• Test your arrangements. Many businesses regularly test cyber incident and business continuity procedures. Fewer test their readiness for a regulatory investigation. Mock investigations and mock dawn raids can help identify weaknesses in existing procedures and provide confidence that teams can respond effectively under pressure.

• Document your compliance and be ready to move quickly. Regulatory deadlines can be demanding. In our experience, businesses often have a very short window in which to formulate an initial response, share relevant information. So clearly documenting your compliance and storing this in a structed way is invaluable and will mean you can make the most of the time available to positively engage with the regulator and leave them with the impression that the business is well run and compliance minded.

• Have a plan in place for dealing with any publicity. This should include having one point of contact for the press and speaking to your PR agency about crisis support in advance.

How we can help you

Mills & Reeve regularly advises businesses facing investigations and regulatory scrutiny across a broad range of regulators, including sector-specific regulators. We support clients with investigation readiness reviews, dawn raid policies, staff training, mock dawn raids and investigations, responses to information requests and engagement with regulators throughout the course of an investigation.

Our content explained