Inside A CMA Investigation – Six Things Your Business Needs To Know Now

In the first half of 2026 alone, the Competition and Markets Authority (CMA) imposed more than GBP5.7M in fines and secured GBP1.95M in consumer refunds. Fines are rising, scrutiny is increasing, and investigations are moving faster than most businesses expect.

In our webinar, “The CMA’s New Consumer Protection Powers in Action”, we set out six things your business needs to understand now about consumer law investigations—and what to do about them.

Consumer law compliance is important

We are no longer in a world where there was the Advertising Standards Authority (ASA) (with limited sanctions) and trading standards (with limited enforcement). The CMA has the desire, resources, and available remedies to make consumer law compliance a far higher priority for businesses. That means reviewing practices and policies, ensuring appropriate levels of review of not just advertising but across the full range of commercial practices, training relevant staff, and being prepared for regulatory interventions.

Expedition is real

The CMA is now under a statutory duty of expedition, and it will remind you of that in your interactions with them. In practice, that means the CMA wants to get on with things and you can’t assume you will be given extensions of deadlines (and definitely not without solid reasons).

You have to be ready, therefore, to react to CMA interventions—usually first in the form of potentially voluminous information notices—quickly. And it won’t be possible to unduly delay or stall an investigation. The CMA does have interim powers, but rarely uses them.

Don’t forget the admin

Document management has become much more important. Consider carefully what documents you want to retain, such as substantiation and other evidence you may need in the event of a challenge. You may also not want to review your document retention policy, including in relation to documents created in the course of developing an ad campaign (or other commercial practice). You are under no specific obligation to retain documents until in receipt of an information notice (IN) or legal claim.

Make sure that any legally privileged documents are clearly marked and ideally kept in a separate folder from other documents. The CMA states that it will typically reject the use of overly generally keywords, such as “privilege” or “privileged”, to identify privileged communications on a search of electronic material. Also consider the confidentiality status of any documents and whether they contain any personal data. The CMA states that it will not accept blanket or unsubstantiated confidentiality claims, and although that’s not a reason not to disclose the documents to the CMA it’s relevant to any subsequent disclosure of the documents/information. There are also strict rules under data protection law governing the use and disclosure of information obtained by the CMA during the course of an investigation.

Review and update policies for use of personal devices and unauthorized/unmonitored messaging platforms (the CMA will likely request documents/information held on them). Put a document hold in place on receipt of an IN, and warn employees not to create any new, non-privileged documents after receipt of the IN (the CMA may issue second INs asking for documents created since the first). Treat an IN like a disclosure exercise (including use of disclosure platforms for any significant volume of documents).

Also think about whether you have insurance coverage for legal costs, regulatory fines, etc. and make any necessary notifications.

Cooperation without capitulation

Keep up your guard at all times in your communications with the CMA. It of course wants to encourage cooperation with its investigation, and you are under a duty to do so, and it is mitigation in the event of sanctions being imposed. But that doesn’t mean that you need to make any unnecessary admissions, or act against your interests, or fail to challenge the CMA if it exceeds its powers or acts unreasonably (there is a prescribed procedure for challenging CMA's decisions in the course of an investigation). Once available internal remedies have been exhausted, if the issue is sufficiently important, and if you believe that the CMA has exceeded their powers or acted unreasonably, then you can consider judicial review of CMA decisions taken either during, or at the conclusion, of its investigations.

Guidance isn’t gospel

The CMA issues a lot of guidance, and generally follows it closely. You need to be familiar with the guidance, and it also helps to stay informed about the CMA’s regular announcements as to its priority areas, enforcement action, and plans for the year.

However, sometimes the CMA’s guidance may “gold plate” the law . It’s important to remember that guidance isn’t law. When it comes to it, the CMA must work within the statutory framework set out in the Digital Markets, Competition and Consumers Act (DMCCA) and secondary legislation. A failure to do so, even if following its guidance, can give rise to grounds for judicial review.

Conversely, if you do follow the CMA’s guidance, or rely on its public pronouncements as to its intentions, and it acts in a way inconsistent with any such guidance or pronouncements, that could also give rise to grounds for a challenge.

Have a plan (including settlement)

At an early stage, do the basics—a merits assessment, a case theory, and a realistic roadmap and outcome. Ensure involvement and buy-in of all key stakeholders (without waiving privilege).

Consider what an acceptable settlement looks like. Engage early with the CMA on settlement (but it may want to gather all the relevant information first). Settlement needs to be reached before a final infringement notice is issued, and a greater discount is available before any provisional infringement notice. Where appropriate, refer to the CMA’s “Four Ps” principles:

• pace
• predictability
• proportionality
• process.

Remember the difference between settlement (admitting liability and an agreed discount on time and mitigation/enforcement steps) and undertakings (no admission). Both parties must agree to both, and the CMA has indicated that it is less inclined to accept undertakings than it has been in the past. The procedure for both types of resolution is set out in CMA guidance.

As with any dispute, you need to have a clear strategy for achieving an acceptable settlement. The CMA won’t want to contest a case and lose, but will take on matters where it feels it necessary and appropriate to do so. Equally, the CMA likes to set precedents to show it is using its new powers for the benefit of consumers and to encourage wider market compliance with consumer law.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.