DMCCA Fines: What 10% of Global Turnover Actually Means for UK Businesses

Ten percent of global annual turnover is the headline figure in the Digital Markets, Competition and Consumers Act 2024. That number looks large and is designed to. The reality for most SMBs facing a first CMA investigation is different: the 10% figure is a statutory ceiling, not a standard outcome, and the CMA's published approach to calculating penalties calibrates downward from that ceiling based on a structured set of factors.

To understand which DMCCA-relevant practices your website currently uses, run a free scan at /uk/en/scan.

The statutory fine framework

Part 4 of the DMCCA 2024 sets out the unfair commercial practices regime and the associated penalty structure. Schedule 6 specifies the CMA's enforcement powers including financial penalties.

The penalty bands under DMCCA Part 4 are:

Business penalties: up to 10% of the business's global annual turnover in the financial year preceding the infringement decision. Where the business's infringement was limited to one part of a wider group, the CMA has discretion to base the turnover calculation on the relevant part.

Individual penalties: up to £300,000 per individual found to have committed or directed the infringement. Officers and directors of businesses can face personal penalties independently of the corporate penalty.

Daily penalties for continuing breaches: up to 5% of the business's global daily turnover for each day an infringement continues after a CMA direction to cease.

Non-compliance penalties: where a business fails to comply with a CMA information notice or other procedural requirement during an investigation, the CMA can impose a separate penalty of up to £30,000 for the failure to cooperate, independent of any substantive infringement penalty.

How the CMA calculates the fine

The CMA published penalty calculation guidance applicable to its DMCCA enforcement powers. The calculation follows a staged approach broadly similar to the ICO's UK GDPR penalty methodology.

The CMA starts by identifying the value of sales directly or indirectly related to the infringement. This is not necessarily the business's full global turnover. A business that runs an e-commerce site with drip-pricing practices on one product category is not automatically assessed at 10% of its entire global turnover. The relevant base is typically the UK turnover affected by the infringing practice.

A starting percentage is applied to that base, reflecting the seriousness of the infringement. Intentional practices designed to deceive consumers attract higher starting percentages than negligent failures to update price displays.

The duration of the infringement multiplies the base amount. A practice running for three years generates a higher penalty than the same practice running for three months.

Mitigating factors that the CMA recognises include: voluntary cessation of the practice before the investigation concluded, co-operation with the investigation, remediation of the affected consumers, no prior regulatory record, and financial capacity considerations that would make the calculated penalty disproportionate.

Aggravating factors include: concealing evidence, previous CMA or Trading Standards action for similar practices, and continuing the practice after becoming aware of the investigation.

Daily penalties and continuing breaches

The continuing-breach daily penalty mechanism is designed to prevent businesses from treating DMCCA enforcement as a cost of doing business. If the CMA issues a direction to cease an infringing practice and the business continues it, the 5% daily rate applies from the date of non-compliance.

For a business with £10 million annual turnover, daily global turnover is approximately £27,000. At 5%, the daily penalty is approximately £1,370 per day. Over 30 days of non-compliance that is £41,000 in daily penalties on top of the underlying infringement penalty, making sustained non-compliance after a CMA direction financially untenable even for smaller businesses.

The practical implication is that once the CMA issues a formal direction, compliance must occur immediately. Delay in remediation while seeking legal advice on appeal does not suspend the daily penalty.

Comparing DMCCA fines to ICO UK GDPR fines

UK businesses subject to both UK GDPR and DMCCA face two separate penalty regimes with different ceilings and different regulators.

UK GDPR's higher tier: up to £17.5 million or 4% of global turnover. DMCCA: up to 10% of global turnover. On the turnover-percentage basis, DMCCA is stricter. On an absolute-pound basis, the ICO has issued larger fines to date because UK GDPR enforcement is more mature.

The regimes can apply simultaneously to the same business for the same underlying facts. A checkout dark pattern that collects consent to marketing without valid GDPR consent is both a DMCCA unfair commercial practice and a potential UK GDPR violation. The ICO and CMA have coordination mechanisms to avoid double-counting harm, but double-exposure remains possible in principle.

Under PECR, which governs cookie and electronic marketing consent, the fine ceiling is £500,000, materially lower than either DMCCA or UK GDPR.

Realistic exposure for SMBs

The 10% ceiling applies to the largest, most serious, intentional and sustained infringements. For a first-time investigation of an SMB that co-operates, ceases the infringing practice promptly and remedies affected consumers, the realistic outcome is significantly lower.

The CMA's approach, drawn from its pre-DMCCA enforcement record, suggests that outcomes for co-operating first-time SMB respondents are more likely to be in the range of low-to-mid single-digit percentages of the affected turnover rather than a global-turnover maximum. Settlement before a formal decision, while providing less public precedent value for businesses seeking certainty about the law, is also an option the CMA uses where it achieves the desired outcome of behavioural change without a contested hearing.

The CMA's investigation procedure and the business's rights

A DMCCA investigation under Part 4 follows a structured procedure with defined rights for the business under investigation.

The CMA begins with information gathering. Under Schedule 6 paragraph 10 of the DMCCA, the CMA can issue information notices requiring the business to produce documents, provide information, or attend interviews. Failure to comply with an information notice is a separate offence carrying penalties of up to £30,000.

After gathering evidence, the CMA issues a provisional decision if it concludes there is a case to answer. The provisional decision sets out the proposed finding of infringement and the proposed penalty. The business has the right to make representations within a specified period, typically 28 days.

After considering representations, the CMA issues a final decision. The final decision is appealable to the Competition Appeal Tribunal (CAT). An appeal to the CAT does not automatically suspend payment of the penalty. The CAT can review the CMA's decision on merits, not merely on judicial review grounds, which means it can substitute a different penalty amount or overturn the infringement finding entirely.

Further appeals from the CAT go to the Court of Appeal on points of law. The full litigation route is expensive and is typically pursued where the penalty is large, the legal questions are genuinely novel, or the finding would have significant precedent implications for the business's wider operations.

What businesses should do if the CMA contacts them

The CMA's initial contact is not always a formal investigation notice. The CMA often sends a preliminary letter or makes an informal approach before opening a formal investigation, giving the business an opportunity to engage voluntarily.

At this stage, the most effective approach is to take the contact seriously, gather relevant documentation about the practice in question, and seek legal advice before responding. Unlike ICO investigations, where the general advice is to respond promptly and fix the problem, DMCCA investigations may involve more complex questions about whether a practice was an infringement at all, given that DMCCA Part 4 is relatively new and the CMA's enforcement interpretations are still developing through early decisions.

Where an informal approach resolves the matter through voluntary change and no penalty is sought, the CMA typically issues no public decision. This outcome is preferable for the business from a reputational perspective and for precedent reasons.

If a formal investigation opens, co-operation is the most significant mitigating factor. Providing requested information promptly, ceasing any practice the CMA has identified as potentially infringing, and remediating affected consumers all reduce the penalty that would otherwise be imposed. The CMA has explicitly recognised co-operation and remediation as mitigating factors in its penalty methodology documentation.

Interaction between DMCCA and Trading Standards

The CMA is not the only body enforcing consumer protection law. Local Trading Standards offices, operating through councils, have concurrent powers to enforce consumer protection legislation including aspects of DMCCA. The Chartered Trading Standards Institute represents local Trading Standards officers.

For SMBs, Trading Standards enforcement is often the first point of contact for consumer protection issues. Trading Standards does not have the same direct-fining powers as the CMA under DMCCA, but can refer cases to the CMA and can take criminal enforcement action for certain offences. A Trading Standards investigation can precede or run alongside a CMA investigation.

For what specific DMCCA-prohibited practices look like in web design, see DMCCA 2024: CMA enforcement of dark patterns. For how UK GDPR penalties compare in the data-protection context, see UK GDPR fines under the ICO.

---

This is technical analysis, not legal advice. Consult a solicitor for specific guidance on DMCCA compliance and CMA investigations.