CMA’s First Use of New Fining Powers Under DMCCA

The Competition and Markets Authority (CMA) has imposed a £473,000.50 penalty on Euro Car Parks Limited after it failed to comply with a formal request for information (RFI) issued in connection with a consumer protection enforcement case.

The fine, issued in December 2025 and published on 13 February 2026, is the CMA’s first official use of its enhanced fining powers under the Digital Markets, Competition and Consumers Act 2024 (DMCCA).

Why does this matter?

There has been a lot of focus on the CMA’s new powers to impose tougher penalties on businesses that breach substantive consumer protection laws (penalties up to 10% of global turnover, if you needed reminding).

There has been perhaps less attention devoted to the CMA’s tougher information gathering powers.

Under the pre-DMCCA consumer enforcement regime, the CMA had to take businesses to court to force them to comply with RFIs if they didn’t engage.

Now, thanks to an amendment to the Consumer Rights Act 2015 introduced by the DMCCA, the CMA can take matters into their own hands and impose civil penalties without going to court. This can result in penalties of up to £30,000 or 1% of global turnover, whichever is higher, plus daily penalties of up to £15,000 per day or 5% of daily turnover.

The CMA will not impose a penalty if the respondent has a “reasonable excuse” for not complying with the RFI (and any associated deadlines). But its own enforcement guidance is clear that it will interpret this very strictly against respondents.

The impact of these changes on CMA consumer enforcement investigations can’t be understated. They significantly shift the balance of power, making it much harder for a company under investigation to ‘play hardball’ with the CMA in responding to RFIs.

Why was Euro Car Parks fined?

The CMA issued Euro Car Parks with its first RFI on 25 July 2025 requiring a response by 4 September 2025 as part of an evidence-gathering exercise preceding a possible consumer protection investigation.

Euro Car Parks failed to acknowledge receipt, failed to respond to further follow up emails in August and missed the 4 September deadline. The CMA hand-delivered a further copy of the RFI the following day and an employee confirmed copies had been provided to a director by hand and email.

Despite seven attempts by the CMA to obtain a response – including via registered post, hand delivery, and multiple emails sent to company directors – it received no reply for three months.

The first engagement from Euro Car Parks came when it was informed a financial penalty was being considered via a provisional notice.

What “reasonable excuse” did Euro Car Parks put forward?

Euro Car Parks offered three main justifications for their previous lack of response.

‍Service issues: The director to whom the notice was addressed was allegedly away and not involved in day-to-day management.
Belief in fraud: Officers claimed they believed CMA emails were fraudulent due to "urgent language", exclamation marks, use of multiple email addresses, classification markings like "Official Sensitive", and the CMA employee signing off with "many thanks". Even when the director saw a letter in early October, they allegedly considered it fraudulent due to the envelope's "unprofessional appearance".‍
Security protocols: The company claimed its decision to block CMA email addresses was based on good faith security measures and was "objectively reasonable".

How did the CMA respond to Euro Car Parks’ attempted justifications?

All of these arguments were rejected by the CMA.

On service, the notice was validly served and ultimately accepted by the company. Additionally, companies are responsible for ensuring compliance regardless of individual officers' absences.

On fraud, the CMA found no objectively reasonable basis. All correspondence used official CMA branding and a gov.uk email address, delivered by hand and post using language and formatting typical of official documents. Critically, Euro Car Parks took no steps to verify legitimacy e.g., no attempts to call the CMA/named officials.

On security protocols, the CMA referred to other companies receiving similar notices having no difficulty complying. The CMA cited Euro Car Parks’ own response to the provisional enforcement notice showed what reasonable conduct should be.

How did the CMA calculate the penalty?

Under the CMA’s stepped penalty calculation guidelines, the starting point for the penalty was assessed by reference to the seriousness of the breach, Euro Car Park’s culpability and its total annual turnover.

The CMA categorised this as a Category 1 breach: the highest category. This was due to Euro Car Park complete failure to comply or engage, which caused significant delay to the investigation. At the date of the provisional notice, the breach had been continuing for 46 days, causing a nearly 2-month delay.

In light of this, the CMA imposed a fine representing 75% of the maximum permitted fixed penalty available (being 1% of annual turnover). As ECP Holdings’ (Euro Car Parks' parent) consolidated turnover for 2024 was £63,093,400, the penalty (0.75% of annual turnover) was calculated at £473,000.50.

In an unusual and somewhat bizarre twist, Euro Car Parks tried to injunct the CMA from publishing its name in connection with the public announcement of the penalty. This application for an injunction was rejected by the High Court following a hearing on 11 February 2026, but it caused two months further delay to the CMA, no doubt further darkening its mood.

Euro Car Parks appeal and next steps

Respondents on the receiving end of CMA civil penalties do, of course, have the right to appeal. Euro Car Parks has appealed the decision, which means the case will go back to the High Court again.

The fine is not payable until this appeal is determined or withdrawn, unless the court orders otherwise.

The CMA emphasised that the penalty relates solely to non‑compliance with the RFI, and that no consumer enforcement case is currently open against Euro Car Parks. The CMA is still assessing the information it has now obtained to decide whether a formal investigation is warranted. This could ultimately lead to a further (larger) penalty if Euro Car Parks is found to have engaged in any unfair commercial practices.

‍Responding to CMA RFIs: what you need to know

This case offers a stark example of how things can go wrong if RFIs from the CMA are ignored or not taken seriously.

It’s worth noting that the Euro Car Parks penalty was calculated against total annual turnover of £63,093,400. While not insignificant, companies with larger annual turnover will be able to assess for themselves what a penalty of 0.75% their annual turnover would look like.

What remains to be seen is how the CMA will deal with other more borderline breaches. For example, in recent years it has taken action against businesses for repeated failure to meet RFI deadlines (see ASDA, 2023) and for adopting an ‘unjustifiably narrow’ definition when identifying which documents were responsive to the RFI (see Tereos, 2024).

These are the kind of battlegrounds we’re likely to see in the coming years for businesses that seek to engage with the CMA, but on robust terms.

It’s important to note that the CMA’s tougher information gathering powers aren’t limited to consumer enforcement. For example, the ability to impose penalties up to 1% of global turnover for non-compliance without reasonable excuse also now apply to RFIs issued in merger control, market studies/investigations and competition enforcement cases (penalties imposed in those cases were previously capped at £30,000 under the pre-DMCCA regime).

This is the case even if the RFI respondent isn’t actively under investigation for breaching consumer or competition law. For example, the pre-DMCCA Asda penalty related to an RFI issued during the CMA’s road fuel market study. The Tereos penalty related to a pre-DMCCA merger control investigation.

All of this underlines the importance of reflecting carefully before responding to any formal RFI issued by the CMA, irrespective of the legal context in which it is issued.

Get in touch

TLT has extensive experience of dealing with RFIs issued by the CMA across all of its functions, including consumer & competition enforcement, market studies, market investigations and SMS investigations.

This includes advising on multiple CMA consumer enforcement matters, both pre and post DMCCA. Speak to us first if you receive an RFI, advisory or warning letter.

‍

Rhiannon Edwards, a trainee solicitor, contributed to this insight article.

This publication is intended for general guidance and represents our understanding of the relevant law and practice as at February 2026. Specific advice should be sought for specific cases. For more information see our terms and conditions.

No items found.

Written by