CMA Enforcement: What subscription businesses need to know
The Competition and Markets Authority is already enforcing the new consumer-protection regime — including the bans on fake reviews and drip pricing — and the subscription-specific rules are expected to come into force in January 2027. This guide explains the CMA’s powers, enforcement priorities, and what evidence you need to protect your business.
Last updated September 2026 · Source: Competition and Markets Authority. This page is for general information only and is not legal advice — consult qualified counsel for advice on your specific situation.
CMA enforcement powers
The DMCC Act gives the CMA significantly strengthened powers compared to its previous consumer enforcement regime. Unlike the old Part 8 Enterprise Act 2002 powers, the CMA can now act faster and impose larger penalties directly — without needing a court order for financial penalties.
Investigation
The CMA can open investigations based on consumer complaints, its own monitoring, or referrals from Trading Standards. Investigations can be triggered by a single complaint.
Compliance Orders
The CMA can issue orders requiring businesses to change their practices. Failing to comply with an order can trigger further significant financial penalties.
Financial Penalties
Fines of up to 10% of global annual turnover or £300,000, whichever is higher. For a business with £5M global turnover, this means up to £500,000.
Public Enforcement
Enforcement decisions are published on the CMA website, naming the business and describing the breach. Reputational damage often exceeds financial penalties.
Why evidence matters
Under the CMA’s direct enforcement regime, businesses are expected to demonstrate compliance on request. If you can’t show you met the requirements, good intentions won’t be enough — which is exactly why keeping clear, timestamped evidence is so important.
High-risk areas and what Evidencee records
Based on CMA guidance, consumer complaint patterns, and early enforcement signals, these are the areas most likely to attract investigation.
Fake and incentivised reviews
High riskThe CMA has named fake reviews and undisclosed incentivised reviews as a top enforcement priority under the DMCC banned-practices regime. Hosting them, commissioning them, or failing to take reasonable steps to remove them is a direct breach.
Evidencee: Evidencee connects to your review sources (Judge.me is verified end to end; Trustpilot, Yotpo, Loox, Okendo, Stamped and Google are connected but not yet verified against a live account), flags bursts of reviews, near-duplicate text, repeat reviewers and ratings that contradict their own text, and records every triage decision — reviewed, actioned or dismissed — with the handler, the time and any note.
Drip pricing on sign-up flows
High riskRevealing taxes, mandatory fees, shipping, or add-on charges only at checkout — instead of in the up-front total — is the canonical DMCC price-clarity breach and a stated CMA priority.
Evidencee: Evidencee runs daily scans of your Shopify catalogue and your Stripe prices and payment links and logs every finding with the source, the missing price component, and the operator who resolved it.
Pre-contract information
High riskCMA has indicated pre-contract information is a priority. Missing, unclear, or buried subscription summaries are a direct breach.
Evidencee: Evidencee records every published version of your pre-contract block with its content hash, and can check your live checkout page for it. You paste the block into your own sign-up or checkout page — Evidencee adds nothing to any checkout by itself.
Cancellation parity
High riskComplex cancellation flows — more steps than sign-up, call centre requirements, waiting periods — are the most common complaint category.
Evidencee: Evidencee grades the sign-up and cancel step counts you record for each channel, and flags any channel where cancelling takes more steps.
Annual renewal notices
High riskFailing to send renewal reminders before annual billing, or sending them too late, is a clear breach with clear evidence trail.
Evidencee: Evidencee schedules each reminder and logs every send as evidence. Reminders are sent for Stripe and GoCardless brands. Shopify shows a subscription only to the app that created it, so Evidencee cannot see who is about to renew and sends no reminders for Shopify shops.
Trial-to-paid conversion
Medium riskConverting free trials to paid subscriptions without adequate notice or pre-contract information is a common enforcement target.
Evidencee: For Stripe brands, Evidencee sends trial-ending reminders, logs each send, and opens a cooling-off case automatically when a trial converts to paid.
Cooling-off refusals
Medium riskRefusing or delaying cooling-off refund requests without documented justification creates enforcement risk.
Evidencee: Evidencee case management records every decision with the handler and timestamp, and every refusal with its reason.
Evidence gaps
High riskClaiming compliance without being able to prove it is as dangerous as non-compliance. The CMA expects businesses to have evidence readily available.
Evidencee: Evidencee's Evidence Vault keeps an exportable, tamper-evident record of the compliance events it records. Every record carries a SHA-256 hash and is linked to the record before it, so a later change to any record shows.
What to have ready if the CMA contacts you
If the CMA opens an investigation, they will request specific documentation. Businesses that can provide this quickly and comprehensively are far better positioned than those scrambling to reconstruct records.
Records of pre-contract information displayed to subscribers
Notice delivery logs with timestamps and recipient evidence
Cancellation flow documentation showing step parity
Cooling-off requests, decisions, and refund records
Drip-pricing scan results and resolution actions for each finding
Fake-review scan results, triage decisions, and review-source connections
Evidence of your DMCC compliance controls and policies
Audit trail of any system changes affecting compliance
Evidencee Audit Bundle Export
Evidencee exports the records for a subscriber, a subscription, a case or a date range as one self-contained HTML bundle, sealed with a SHA-256 Merkle-root manifest — up to 5,000 records at a time. Every record in it carries its SHA-256 hash and its place in a continuous linked chain, so the bundle itself shows whether anything in it was changed.